Actively exploited · Published Sep 23, 2021 · Assigned by hackerone

CVE-2021-22941

Critical 9.8 Exploited Ransomware

In plain English

A critical-severity improper access control in Citrix ShareFile storage zones controller. Attackers are actively exploiting it in the wild (listed by CISA on March 25, 2022). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 53.6% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply updates per vendor instructions.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)53.6%top 1.0% of all CVEs

Exploited in the wildYesCISA KEV since Mar 25, 2022

Attack tooling1Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Apr 15, 2022.

Official description

Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacker to remotely compromise the storage zones controller.

Affected products (as reported)

Vendor	Product	Versions
n/a	Citrix ShareFile storage zones controller	5.11.20

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://support.citrix.com/article/CTX328123 x_refsource_MISC
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22941 government-resource