CVE-2021-22932 Weak cryptography in Citrix ShareFile Storage Zones Controller
Running a specific mitigation tool disables file encryption, potentially exposing stored data to unauthorized access if not manually re-enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-22932?
CVE-2021-22932 is a high-severity vulnerability in Citrix ShareFile Storage Zones Controller, published on 16 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue has been identified in the CTX269106 mitigation tool for Citrix ShareFile storage zones controller which causes the ShareFile file encryption option to become disabled if it had previously been enabled. Customers are only affected by this issue if they previously selected “Enable Encryption” in the ShareFile configuration page and did not re-select this setting after running the CTX269106 mitigation tool. ShareFile customers who have not run the CTX269106 mitigation tool or who re-selected “Enable Encryption” immediately after running the tool are unaffected by this issue.
Weakness: CWE-311
Which versions are affected by CVE-2021-22932?
It affects 1 product.
Products include Citrix Sharefile Storagezones Controller.
How do I fix CVE-2021-22932?
No fix has been published for CVE-2021-22932 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-22932 being exploited?
There is no known exploitation of CVE-2021-22932 in the wild and no public exploit code.
Other vulnerabilities in Citrix ShareFile Storage Zones Controller
Sources
Also known as GHSA-72xq-94wh-w6jc.