CVE-2020-8200 — Improper Authentication in Citrix Storefront Server

CWE-287 — Improper Authentication4 documents3 sources
Severity
6.5MEDIUMNVD
EPSS
0.3%
top 48.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Citrix Storefront ServerCitrix StorefrontCitrix Virtual Apps AND Desktops+2 more
Timeline
PublishedSep 18
Latest updateMay 24

Description

Improper authentication in Citrix StoreFront Server < 1912.0.1000 allows an attacker who is authenticated on the same Microsoft Active Directory domain as a Citrix StoreFront server to read arbitrary files from that server.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages5 packages

▶NVDcitrix/storefront_server3.0 — 3.0.8001+3

🔴Vulnerability Details

1
GHSA
GHSA-w42q-r5v6-qw8j: Improper authentication in Citrix StoreFront Server < 1912↗2022-05-24
▶

📋Vendor Advisories

2
Citrix
CVE-2020-8200: Improper authentication in Citrix StoreFront Server < 1912.0.1000 allows an attacker who is authenticated on the same Microsoft Active Directory domai↗2020-09-18
▶
Citrix
Citrix StoreFront Security Update - Security Bulletin↗2020-09-10
▶