CVE-2020-8275 Missing authorization in Citrix Secure Mail for Android
An attacker with local code execution or a malicious app can read limited calendar data due to improper access control in Citrix Secure Mail for Android.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-8275?
CVE-2020-8275 is a medium-severity missing authorization vulnerability in Citrix Secure Mail for Android, published on 6 Jan 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Citrix Secure Mail for Android before 20.11.0 suffers from improper access control allowing unauthenticated access to read limited calendar related data stored within Secure Mail. Note that a malicious app would need to be installed on the Android device or a threat actor would need to execute arbitrary code on the Android device.
Which versions are affected by CVE-2020-8275?
It affects 1 product.
Products include Citrix Secure Mail.
How do I fix CVE-2020-8275?
No fix has been published for CVE-2020-8275 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2020-8275 being exploited?
There is no known exploitation of CVE-2020-8275 in the wild and no public exploit code.
Other vulnerabilities in Citrix Secure Mail for Android
Sources
Also known as GHSA-q23c-mjcp-8vj6.