An unauthenticated arbitrary file read issue exists in all versions of Citrix ShareFile…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.
Summary
An unauthenticated arbitrary file read issue exists in all versions of Citrix ShareFile StorageZones (aka storage zones) Controller, including the most recent 5.10.x releases as of May 2020. RCE and file access is granted to everything hosted by ShareFile, be it on-premise or inside Citrix Cloud itself (both are internet facing). NOTE: unlike most CVEs, exploitability depends on the product version that was in use when a particular setup step was performed, NOT the product version that is in use during a current assessment of a CVE consumer's product inventory. Specifically, the vulnerability can be exploited if a storage zone was created by one of these product versions: 5.9.0, 5.8.0, 5.7.0, 5.6.0, 5.5.0, or earlier. This CVE differs from CVE-2020-7473 and CVE-2020-8983.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:citrix:sharefile_storagezones_controller:*:*:*:*:*:*:*:* | up to 5.5.0 | Vulnerable | Citrix |
| cpe:2.3:a:citrix:sharefile_storagezones_controller:5.6.0:*:*:*:*:*:*:* | 5.6.0 | Vulnerable | Citrix |
| cpe:2.3:a:citrix:sharefile_storagezones_controller:5.7.0:*:*:*:*:*:*:* | 5.7.0 | Vulnerable | Citrix |
| cpe:2.3:a:citrix:sharefile_storagezones_controller:5.8.0:*:*:*:*:*:*:* | 5.8.0 | Vulnerable | Citrix |
| cpe:2.3:a:citrix:sharefile_storagezones_controller:5.9.0:*:*:*:*:*:*:* | 5.9.0 | Vulnerable | Citrix |
- cpe:2.3:a:citrix:sharefile_storagezones_controller:*:*:*:*:*:*:*:* Versions up to 5.5.0 Vulnerable ·Citrix
- cpe:2.3:a:citrix:sharefile_storagezones_controller:5.6.0:*:*:*:*:*:*:* Versions 5.6.0 Vulnerable ·Citrix
- cpe:2.3:a:citrix:sharefile_storagezones_controller:5.7.0:*:*:*:*:*:*:* Versions 5.7.0 Vulnerable ·Citrix
- cpe:2.3:a:citrix:sharefile_storagezones_controller:5.8.0:*:*:*:*:*:*:* Versions 5.8.0 Vulnerable ·Citrix
- cpe:2.3:a:citrix:sharefile_storagezones_controller:5.9.0:*:*:*:*:*:*:* Versions 5.9.0 Vulnerable ·Citrix
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-8982
- 2026-10-03 Alias added: GHSA-xqh7-34g2-j95q
References
More Citrix Sharefile Storagezones Controller vulnerabilities
- TI-2021-05802 Improper access control in Citrix ShareFile storage zones controller KEVCVSS 3.1CRITICAL 9.8
- TI-2020-05996 In certain situations, all versions of Citrix ShareFile StorageZones (aka storage zones)… CVSS 3.1HIGH 7.5
- TI-2021-05752 Missing authorization in Citrix ShareFile Storage Zones Controller CVSS 3.1CRITICAL 9.8
- TI-2020-07207 An arbitrary file write issue exists in all versions of Citrix ShareFile StorageZones… CVSS 3.1HIGH 7.5
- TI-2021-05793 An issue has been identified in the CTX269106 mitigation tool for Citrix ShareFile… CVSS 3.1HIGH 7.5
- TI-2018-12122 Citrix ShareFile StorageZones Controller before 5.4.2 has Information Exposure Through an Error Message. CVSS 3.0MEDIUM 4.3
Sources
- CVE-2020-8982 · CVE Program
- CVE-2020-8982 · NVD
- FIRST EPSS
- GHSA-xqh7-34g2-j95q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences