CVE-2019-7218 — Improper Authentication in Citrix Sharefile

CWE-287 — Improper Authentication3 documents3 sources
Severity
5.9MEDIUMNVD
EPSS
0.3%
top 49.60%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Citrix Sharefile
Timeline
PublishedMay 13
Latest updateMay 24

Description

Citrix ShareFile before 19.23 allows a downgrade from two-factor authentication to one-factor authentication. An attacker with access to the offline victim's otp physical token or virtual app (like google authenticator) is able to bypass the first authentication phase (username/password mechanism) and log-in using username/otp combination only (phase 2 of 2FA).

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 2.2 | Impact: 3.6

Affected Packages2 packages

🔴Vulnerability Details

1
GHSA
GHSA-qqgh-6pjq-jp6c: Citrix ShareFile through 19↗2022-05-24
▶

📋Vendor Advisories

1
Citrix
CVE-2019-7218: Citrix ShareFile before 19.23 allows a downgrade from two-factor authentication to one-factor authentication. An attacker with access to the offline v↗2019-05-13
▶