CVE-2023-24489
Quick assessment
Affected
Citrix Citrix ShareFile Storage Zones Controller
Exploitation
Confirmed exploitation in the wild; remediate immediately
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Citrix Systems Content Collaboration是美国思杰系统（Citrix Systems）公司的一种安全的企业文件同步和共享服务。可满足用户的移动和协作需求以及企业的数据安全要求。 Citrix Systems Content Collaboration存在安全漏洞，该漏洞源于 ShareFile StorageZones Controller 存在不正确的资源控制漏洞。
Public Exploits 1
Nuclei · 1
CVE-2023-24489.yaml [template]
In-the-Wild Activity Observed
cisa_kev · confirmed
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-24489
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated attacker to remotely compromise the customer-managed ShareFile storage zones controller.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
访问控制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Citrix Systems Content Collaboration 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Citrix Systems Content Collaboration是美国思杰系统（Citrix Systems）公司的一种安全的企业文件同步和共享服务。可满足用户的移动和协作需求以及企业的数据安全要求。 Citrix Systems Content Collaboration存在安全漏洞，该漏洞源于 ShareFile StorageZones Controller 存在不正确的资源控制漏洞。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Citrix | Citrix ShareFile Storage Zones Controller | 0 ~ 5.11.24 | - |
|
II. Public POCs for CVE-2023-24489
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | This project is a Python script that exploits the CVE-2023-24489 vulnerability in ShareFile. It allows remote command execution on the target server. The script supports both Windows and Linux (On testing) platforms, and it can be used to exploit individual targets or perform mass checking on a list of URLs. | https://github.com/adhikara13/CVE-2023-24489-ShareFile | POC Details |
| 2 | POC for CVE-2023-24489 with bash. | https://github.com/whalebone7/CVE-2023-24489-poc | POC Details |
| 3 | A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated attacker to remotely compromise the customer-managed ShareFile storage zones controller. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-24489.yaml | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-24489
请登录查看更多情报信息。
Other References for CVE-2023-24489 (1)
Same Patch Batch · Citrix · 2023-07-10 · 5 CVEs total
| CVE-2023-24487 | 6.3 MEDIUM | Arbitrary file read |
| CVE-2023-24490 | 6.3 MEDIUM | Users with only access to launch VDA applications can launch an unauthorized desktop |
| CVE-2023-24488 | 6.1 MEDIUM | Cross site scripting |
| CVE-2023-24486 | Local user access to a system where another user is utilizing a vulnerable version of Citr |
IV. Related Vulnerabilities
Same vendor: Citrix
-
CVE-2026-78547
Out-of-Bounds Write -
CVE-2026-18751
Citrix Workspace App for Mac Security Bulletin for CVE-2026- -
CVE-2026-53566
Out-of-bounds memory read -
CVE-2026-53565
Local Privilege escalation allows a low-privileged user to g -
CVE-2025-6759
Local Privilege escalation allows a low-privileged user to g
Same weakness: CWE-284
-
CVE-2026-76142
Genians, Inc. Genian NAC/ZTNA Improper Access Control on the -
CVE-2026-103534
David-Crty databasement Snapshot Model snapshots SnapshotPol -
CVE-2026-102132
Kiteworks Core Privilege Escalation through Improper Access -
CVE-2026-55494
Tugtainer: Unauthenticated access to Tugtainer Agent Docker -
CVE-2026-55181
Tugtainer: OIDC login remains accessible when OIDC_ENABLED i
V. Comments for CVE-2023-24489
No comments yet