High severity · published May 13, 2019
CVE-2019-7217
Citrix ShareFile before 19.12 allows User Enumeration
7.5
CVSS
2%
EPSS
No
On KEV
Description
Citrix ShareFile before 19.12 allows User Enumeration. It is possible to enumerate application username based on different server responses using the request to check the otp code. No authentication is required.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SH
Sharefile · Citrix
before 19.12 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-7217
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-7217
Exploit
http://www.sk-it.com/en/cve.html
More from Sharefile
9.8
CVE-2021-22941
Citrix ShareFile Improper Access Control Vulnerability
5.9
CVE-2019-7218
Citrix ShareFile before 19.23 allows a downgrade from two-factor authentication to one-factor authentication