CVE-2020-8983

An arbitrary file write issue exists in all versions of Citrix ShareFile StorageZones (aka storage zones) Controller, including the most recent 5.10.x releases as of May 2020, which allows remote code execution. RCE and file access is granted to everything hosted by ShareFile, be it on-premise or inside Citrix Cloud itself (both are internet facing). NOTE: unlike most CVEs, exploitability depends on the product version that was in use when a particular setup step was performed, NOT the product version that is in use during a current assessment of a CVE consumer's product inventory. Specifically, the vulnerability can be exploited if a storage zone was created by one of these product versions: 5.9.0, 5.8.0, 5.7.0, 5.6.0, 5.5.0, or earlier. This CVE differs from CVE-2020-7473 and CVE-2020-8982.

• CWE-22

• https://drive.google.com/file/d/15iy6S8CN9Hku0a2zrcrXK9FAocmQvMwT/view?usp=sharing
• https://support.citrix.com/article/CTX269106Vendor Advisory
• https://www.linkedin.com/posts/jonas-hansen-2a2606b_citrix-sharefile-storage-zones-controller-activity-6663432907455025152-8_w6/
• https://drive.google.com/file/d/15iy6S8CN9Hku0a2zrcrXK9FAocmQvMwT/view?usp=sharing
• https://support.citrix.com/article/CTX269106Vendor Advisory
• https://www.linkedin.com/posts/jonas-hansen-2a2606b_citrix-sharefile-storage-zones-controller-activity-6663432907455025152-8_w6/

Published

May 7, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-8973ZGR TPS200 NG in its 2.00 firmware version and 1.01 hardware…8.1
• CVE-2020-8974In ZGR TPS200 NG 2.00 firmware version and 1.01 hardware ver…9.1
• CVE-2020-8975ZGR TPS200 NG in its 2.00 firmware version and 1.01 hardware…7.5
• CVE-2020-8976The integrated server of the ZGR TPS200 NG on its 2.00 firmw…8.8
• CVE-2020-8981A cross-site scripting (XSS) vulnerability was discovered in…6.1
• CVE-2020-8982An unauthenticated arbitrary file read issue exists in all v…7.5
• CVE-2020-8984lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta allowed IP…7.5
• CVE-2020-8985ZendTo prior to 5.22-2 Beta allowed reflected XSS and CSRF v…8.8
• CVE-2020-8986lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to …9.8
• CVE-2020-8987Avast AntiTrack before 1.5.1.172 and AVG Antitrack before 2.…7.4
• CVE-2020-8988The Voatz application 2020-01-01 for Android allows only 100…5.9
• CVE-2020-8989In the Voatz application 2020-01-01 for Android, the amount …5.3