CVE-2023-24489KEV · OVERDUECWE-284

Citrix Content Collaboration ShareFile Improper Access Control Vulnerability

Critical · published July 10, 2023

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.

1144
days past CISA
deadline
CVSS v3.1
9.8
EPSS
97%
Percentile
99.9
In the wild
Confirmed
What it is

🚨 An unauthenticated attacker can remotely seize control of your ShareFile storage controller — that’s like leaving your front door wide open and inviting thieves in! 🔥 Think of the ShareFile storage zones controller as a vault where you keep your most prized possessions. If that vault’s door is unlocked, anyone can stroll in, take what they want, or even change the locks without you ever knowing! This vulnerability is absolutely devastating: it allows attackers to access and manipulate sensitive files without any authentication. They could compromise your data integrity, steal sensitive information, or wreak havoc on your entire storage system, leaving you in a world of hurt.

Put simply

Think of the ShareFile storage zones controller as a vault where you keep your most prized possessions. If that vault’s door is unlocked, anyone can stroll in, take what they want, or even change the locks without you ever knowing! CVE-2023-24489 is a critical vulnerability in customer-managed ShareFile storage zones where an unauthenticated attacker can exploit the system remotely, gaining unauthorized access and control over the sensitive storage environment.

What to do

This vulnerability is absolutely devastating: it allows attackers to access and manipulate sensitive files without any authentication. They could compromise your data integrity, steal sensitive information, or wreak havoc on your entire storage system, leaving you in a world of hurt. To protect yourself, immediately patch to the latest version provided by Citrix. Additionally, review your access controls and monitor for any suspicious activity in your ShareFile environment. Staying informed and vigilant is key! You've got this! Follow these steps, and you'll ensure your ShareFile environment is secure in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.97343 · 99.9th percentile
Weakness
CWE-284 · Improper Access Control
Published
2023-07-10T21:11Z
KEV added
2023-08-16 · due 2023-09-06
EPSS history
Timeline
  • 16 AUG 00:00Z
    Added to CISA KEV — remediate by Sep 6
    kev
  • 10 JUL 21:11Z
    A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated attacker to…
    cvelistv5