Citrix this week announced that updates released for Citrix ShareFile storage zones controllers address several information disclosure vulnerabilities.
ShareFile is a content collaboration, file sharing and sync solution that provides users with the option to painlessly share documents. For enterprises, the service includes a storage zones controller and the User Management Tool, allowing customers to manage their own data storage.
With storage zones controllers, the ShareFile Software-as-a-Service (SaaS) cloud storage also offers private storage for ShareFile data, which is known as storage zones.
The recently patched vulnerabilities, Citrix says, were identified in customer-managed Citrix ShareFile storage zone controllers.
“These vulnerabilities, if exploited, would allow an unauthenticated attacker to compromise the storage zones controller potentially giving an attacker the ability to access ShareFile users’ documents and folders,” the company explains in an advisory.
Three different vulnerabilities received patches: CVE-2020-7473, CVE-2020-8982, and CVE-2020-8983, with the list of affected products including ShareFile Storage Zones Controller versions 5.5.0 to 5.9.0, as well as all earlier versions of ShareFile StorageZones Controller.
Citrix addressed the issues in Storage Zones Controller 5.10.0 and later, 5.9.1 and later, 5.8.1 and later, and 5.7.1 and later, as well as in ShareFile StorageZones Controller 5.6.1 and later, and 5.5.1 and later.
“Storage zones created using a vulnerable version of the storage zones controller are at risk even if the storage zones controller has been subsequently updated,” Citrix adds.
The issue only impacts organizations with customer-managed storage zones, which are advised to run a mitigation tool Citrix has released for them, on storage zones controllers managing each impacted storage zone.
The company also announced that it is currently notifying customers and channel partners with customer-managed storage zones controllers of this potential security issue.
Related: Organizations Quick to Patch Critical Citrix ADC Vulnerability
Related: China’s APT41 Exploited Citrix, Cisco, ManageEngine Flaws in Global Campaign
Related: Hackers Exploiting Recently Patched ManageEngine Desktop Central Vulnerability