CVE-2023-24489 is a critical improper access control vulnerability affecting customer-managed Citrix ShareFile Storage Zones Controllers. An unauthenticated attacker can remotely compromise affected systems, leading to complete loss of confidentiality, integrity, and availability. With a CVSS score of 9.8 and a FAUCET Risk Score of 100/100, this vulnerability is highly severe and easily exploitable over the network without user interaction. CISA has confirmed active exploitation in the wild, and while no Metasploit or ExploitDB modules exist, Nuclei templates are available. The vulnerability has garnered significant community discussion and media coverage, underscoring its critical nature and the urgency for patching.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 5.11.24CPE matchmatch criteria | cpe:2.3:a:citrix:sharefile_storage_zones_controller:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.