What is CVE-2023-24489?

CVE-2023-24489 is a critical vulnerability affecting customer-managed ShareFile storage zones controllers. With a severity score of 9.8, this vulnerability allows an unauthenticated attacker to remotely compromise the controller, posing a significant risk to affected systems. It impacts all currently supported versions of the customer-managed ShareFile storage zones controller before version 5.11.24. To protect against this vulnerability, it is essential to upgrade to the fixed version (5.11.24 or later) of the ShareFile storage zones controller.

Who is impacted?

The CVE-2023-24489 vulnerability affects users of the customer-managed ShareFile storage zones controller. If you're using any of the currently supported versions before 5.11.24, your system is at risk. This critical vulnerability allows an unauthenticated attacker to remotely compromise the controller, posing a significant threat to affected systems. It's important to be aware of this issue and take necessary precautions to protect your organization's data and resources.

What to do if CVE-2023-24489 affected you

If you're affected by the CVE-2023-24489 vulnerability, it's crucial to take action to protect your organization's data and resources. Follow these steps:

1. Check the version of your customer-managed ShareFile storage zones controller. If it's earlier than 5.11.24, you're affected.

2. Upgrade to the fixed version (5.11.24 or later) of the ShareFile storage zones controller. Download the latest version from the Citrix website.

3. Follow the instructions provided by Citrix for upgrading the Storage Zones Controller.

4. Shut down any machine running an affected version of the storage zones controller software.

Is it in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-24489 vulnerability, also known as Citrix Content Collaboration ShareFile Improper Access Control Vulnerability, is indeed listed in CISA's Known Exploited Vulnerabilities Catalog. It was added to the catalog on August 16, 2023, with a due date for mitigation set for September 6, 2023. The required action is to apply mitigations per vendor instructions or discontinue the use of the product if mitigations are unavailable.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-284, which involves improper access control issues.

Learn More

CVE-2023-24489 is a critical vulnerability affecting customer-managed ShareFile storage zones controllers, posing a significant risk to affected systems. For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the resources listed below.

• Citrix: ShareFile StorageZones Controller Security Update for CVE-2023-24489

• CISA: BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities

• CISA: Known Exploited Vulnerabilities Catalog