Warning: Citrix ShareFile Flaw Could Let Attackers Steal Corporate Secrets

Since the past few weeks, software giant Citrix has privately been rolling out a critical software update to its enterprise customers that patches multiple security vulnerabilities affecting Citrix ShareFile content collaboration platform. The security advisory—about which The Hacker News learned...

CVE-2019-7218

Citrix ShareFile before 19.23 allows a downgrade from two-factor authentication to one-factor authentication. An attacker with access to the offline victim's otp physical token or virtual app like google authenticator is able to bypass the first authentication phase username/password mechanism an...

CVE-2019-7217

Citrix ShareFile before 19.12 allows User Enumeration. It is possible to enumerate application username based on different server responses using the request to check the otp code. No authentication is required...

CVE-2019-7218

Citrix ShareFile before 19.23 allows a downgrade from two-factor authentication to one-factor authentication. An attacker with access to the offline victim's otp physical token or virtual app like google authenticator is able to bypass the first authentication phase username/password mechanism an...

Cross site request forgery (csrf)

Citrix ShareFile before 19.12 allows User Enumeration. It is possible to enumerate application username based on different server responses using the request to check the otp code. No authentication is required...

Authentication flaw

Citrix ShareFile before 19.23 allows a downgrade from two-factor authentication to one-factor authentication. An attacker with access to the offline victim's otp physical token or virtual app like google authenticator is able to bypass the first authentication phase username/password mechanism an...

CVE-2019-7218

Citrix ShareFile vulnerable to a downgrade of authentication from two-factor to one-factor for versions before 19.23. An attacker who has access to the victim’s OTP token or authenticator app could bypass the username/password step and log in with username/OTP only. The issue affects the 2FA logi...

CVE-2019-7217

Citrix ShareFile before 19.12 allows User Enumeration. It is possible to enumerate application username based on different server responses using the request to check the otp code. No authentication is required...

CVE-2019-7218: Improper Authentication

Citrix ShareFile before 19.23 allows a downgrade from two-factor authentication to one-factor authentication. An attacker with access to the offline victim's otp physical token or virtual app like google authenticator is able to bypass the first authentication phase username/password mechanism an...

CVE-2019-7217: Observable Discrepancy

Citrix ShareFile before 19.12 allows User Enumeration. It is possible to enumerate application username based on different server responses using the request to check the otp code. No authentication is required...

PT-2019-18469

Name of the Vulnerable Software and Affected Versions Citrix ShareFile versions prior to 19.12 Description The issue allows user enumeration, where it is possible to determine application usernames based on different server responses. This can be achieved by sending a request to check the otp cod...

PT-2019-18470

Name of the Vulnerable Software and Affected Versions Citrix ShareFile versions prior to 19.23 Description The issue allows an attacker to downgrade from two-factor authentication to one-factor authentication. If an attacker has access to the victim's OTP physical token or virtual app, such as...

CVE-2018-16969

Citrix ShareFile StorageZones Controller before 5.4.2 has Information Exposure Through an Error Message...

CVE-2018-16968

Citrix ShareFile StorageZones Controller before 5.4.2 allows Directory Traversal...

CVE-2018-16969

Citrix ShareFile StorageZones Controller before 5.4.2 has Information Exposure Through an Error Message...

Design/Logic Flaw

Citrix ShareFile StorageZones Controller before 5.4.2 has Information Exposure Through an Error Message...

Directory traversal

Citrix ShareFile StorageZones Controller before 5.4.2 allows Directory Traversal...

CVE-2018-16968

Citrix ShareFile StorageZones Controller before 5.4.2 allows Directory Traversal...

CVE-2018-16969

Citrix ShareFile StorageZones Controller before 5.4.2 has Information Exposure Through an Error Message...

PT-2018-13802

Name of the Vulnerable Software and Affected Versions Citrix ShareFile StorageZones Controller versions prior to 5.4.2 Description The issue allows for information exposure through an error message. Recommendations For versions prior to 5.4.2, update to version 5.4.2 or later to resolve the issue...