CVE-2020-8982 is an unauthenticated arbitrary file read vulnerability affecting Citrix ShareFile StorageZones Controller, including versions up to 5.10.x. This flaw allows attackers to read sensitive files, potentially leading to remote code execution and full access to data hosted by ShareFile, regardless of whether it's on-premise or in Citrix Cloud. The vulnerability's exploitability is contingent on the storage zone having been initially created by older product versions (5.9.0 or earlier). With a CVSS score of 7.5 (High) and an EPSS score indicating high exploitability, this vulnerability poses a significant risk. Its attack vector is network-based with low attack complexity, requiring no privileges or user interaction, and leading to high confidentiality impact. While not listed on the KEV catalog, Nuclei templates exist for detecting this vulnerability. Community discussion and media coverage indicate significant attention, with articles highlighting the critical nature of the flaw and its potential to expose private files.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 5.5.0CPE matchmatch criteria | cpe:2.3:a:citrix:sharefile_storagezones_controller:*:*:*:*:*:*:*:* | ||
5.6.0CPE matchmatch criteria | cpe:2.3:a:citrix:sharefile_storagezones_controller:5.6.0:*:*:*:*:*:*:* | ||
5.7.0CPE matchmatch criteria | cpe:2.3:a:citrix:sharefile_storagezones_controller:5.7.0:*:*:*:*:*:*:* | ||
5.8.0CPE matchmatch criteria | cpe:2.3:a:citrix:sharefile_storagezones_controller:5.8.0:*:*:*:*:*:*:* | ||
5.9.0CPE matchmatch criteria | cpe:2.3:a:citrix:sharefile_storagezones_controller:5.9.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.