Vulnerability Details : CVE-2023-24489
A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated attacker to remotely compromise the customer-managed ShareFile storage zones controller.
Vulnerability category: BypassGain privilege
Products affected by CVE-2023-24489
- cpe:2.3:a:citrix:sharefile_storage_zones_controller:*:*:*:*:*:*:*:*
CVE-2023-24489 is in the CISA Known Exploited Vulnerabilities Catalog
CISA vulnerability name:
Citrix Content Collaboration ShareFile Improper Access Control Vulnerability
CISA required action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA description:
Citrix Content Collaboration contains an improper access control vulnerability that could allow an unauthenticated attacker to remotely compromise customer-managed ShareFile storage zones controllers.
Notes:
https://support.citrix.com/article/CTX559517/sharefile-storagezones-controller-security-update-for-cve202324489; https://nvd.nist.gov/vuln/detail/CVE-2023-24489
Added on
2023-08-16
Action due date
2023-09-06
Exploit prediction scoring system (EPSS) score for CVE-2023-24489
97.27%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 100 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-24489
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST | |
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
Citrix Systems, Inc. |
CWE ids for CVE-2023-24489
-
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.Assigned by: secure@citrix.com (Secondary)
References for CVE-2023-24489
-
https://support.citrix.com/article/CTX559517/sharefile-storagezones-controller-security-update-for-cve202324489
ShareFile StorageZones Controller Security Update for CVE-2023-24489Vendor Advisory
Jump to