ShareFile < 5.11.20 RCE (CVE-2021-22941)

critical Nessus Plugin ID 156614

Language:

Synopsis

The Citrix Sharefile Storage Zones Controller instance found on the remote host is affected by a remote code vulnerability.

Description

A remote code execution vulnerability exists in Citrix ShareFile StorageZones Controller due to improper access control. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands.

Solution

Update ShareFile storage zone controller to 5.11.20 or later.

See Also

https://support.citrix.com/article/CTX328123

Plugin Details

Severity: Critical

ID: 156614

File Name: citrix_sharefile_controller_CVE-2021-22941.nbin

Version: 1.22

Type: remote

Family: Web Servers

Published: 1/11/2022

Updated: 3/8/2023

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.7

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: E:H/RL:OF/RC:C

CVSS Score Source: CVE-2021-22941

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 9.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: E:H/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:citrix:sharefile

Required KB Items: installed_sw/Citrix ShareFile StorageZones Controller

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/8/2021

Vulnerability Publication Date: 9/8/2021

CISA Known Exploited Dates: 4/15/2022

Reference Information

CVE: CVE-2021-22941