Citrix this week announced that updates released for Citrix ShareFile storage zones controllers address several information disclosure vulnerabilities.
ShareFile is a content collaboration, file sharing and sync solution that provides users with the option to painlessly share documents. For enterprises, the service includes a storage zones controller and the User Management Tool, allowing customers to manage their own data storage.
With storage zones controllers, the ShareFile Software-as-a-Service (SaaS) cloud storage also offers private storage for ShareFile data, which is known as storage zones.
The recently patched vulnerabilities, Citrix says, were identified in customer-managed Citrix ShareFile storage zone controllers.
“These vulnerabilities, if exploited, would allow an unauthenticated attacker to compromise the storage zones controller potentially giving an attacker the ability to access ShareFile users’ documents and folders,” the company explains in an advisory.
Three different vulnerabilities received patches: CVE-2020-7473, CVE-2020-8982, and CVE-2020-8983, with the list of affected products including ShareFile Storage Zones Controller versions 5.5.0 to 5.9.0, as well as all earlier versions of ShareFile StorageZones Controller.
Citrix addressed the issues in Storage Zones Controller 5.10.0 and later, 5.9.1 and later, 5.8.1 and later, and 5.7.1 and later, as well as in ShareFile StorageZones Controller 5.6.1 and later, and 5.5.1 and later.
“Storage zones created using a vulnerable version of the storage zones controller are at risk even if the storage zones controller has been subsequently updated,” Citrix adds.
The issue only impacts organizations with customer-managed storage zones, which are advised to run a mitigation tool Citrix has released for them, on storage zones controllers managing each impacted storage zone.
The company also announced that it is currently notifying customers and channel partners with customer-managed storage zones controllers of this potential security issue.
Related: Organizations Quick to Patch Critical Citrix ADC Vulnerability
Related: China’s APT41 Exploited Citrix, Cisco, ManageEngine Flaws in Global Campaign
Related: Hackers Exploiting Recently Patched ManageEngine Desktop Central Vulnerability
More from Ionut Arghire
- KeePass Update Patches Vulnerability Exposing Master Password
- Google Workspace Gets Passkey Authentication
- Cybersecurity Startup Elba Raises €2.5 Million for Employee-Focused Product
- Apple Unveils Upcoming Privacy and Security Features
- Dozens of Malicious Extensions Found in Chrome Web Store
- Microsoft Makes SMB Signing Default Requirement in Windows 11 to Boost Security
- Zyxel Urges Customers to Patch Firewalls Against Exploited Vulnerabilities
- Gigabyte Rolls Out BIOS Updates to Remove Backdoor From Motherboards
Latest News
- KeePass Update Patches Vulnerability Exposing Master Password
- AntChain, Intel Create New Privacy-Preserving Computing Platform for AI Training
- Keep Aware Raises $2.4M to Eliminate Browser Blind Spots
- Google Workspace Gets Passkey Authentication
- Cybersecurity Startup Elba Raises €2.5 Million for Employee-Focused Product
- Zoom Expands Privacy Options for European Customers
- Several Major Organizations Confirm Being Impacted by MOVEit Attack
- Apple Unveils Upcoming Privacy and Security Features
