CVE-2020-8274

Citrix Secure Mail for Android before 20.11.0 suffers from Improper Control of Generation of Code ('Code Injection') by allowing unauthenticated access to read data stored within Secure Mail. Note that a malicious app would need to be installed on the Android device or a threat actor would need to execute arbitrary code on the Android device.

CVSS v3 6.5 MEDIUM
CVSS v2.0 4.3 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://support.citrix.com/article/CTX286763	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:citrix:secure_mail:*:*:*:*:*:android:*:*

History

No history.

Information

Published : 2021-01-06 21:15

Updated : 2024-02-04 21:23

NVD link : CVE-2020-8274

Mitre link : CVE-2020-8274

CVE.ORG link : CVE-2020-8274

JSON object : View

Products Affected

citrix

secure_mail

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2020-8274", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2021-01-06T21:15:14.473", "references": [{"url": "https://support.citrix.com/article/CTX286763", "tags": ["Vendor Advisory"], "source": "support@hackerone.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-94"}]}, {"type": "Secondary", "source": "support@hackerone.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Citrix Secure Mail for Android before 20.11.0 suffers from Improper Control of Generation of Code ('Code Injection') by allowing unauthenticated access to read data stored within Secure Mail. Note that a malicious app would need to be installed on the Android device or a threat actor would need to execute arbitrary code on the Android device."}, {"lang": "es", "value": "Citrix Secure Mail para Android versiones anteriores a 20.11.0, sufre de un Control Inapropiado de la Generaci\u00f3n de C\u00f3digo (\"Code Injection\") al permitir el acceso no autenticado para leer los datos almacenados en Secure Mail. Tome en cuenta que se necesitar\u00eda instalar una aplicaci\u00f3n maliciosa en el dispositivo Android o un actor de amenazas tendr\u00eda que ejecutar c\u00f3digo arbitrario en el dispositivo Android"}], "lastModified": "2021-01-12T16:00:00.070", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:citrix:secure_mail:*:*:*:*:*:android:*:*", "vulnerable": true, "matchCriteriaId": "62E7A966-BD38-419D-8072-806F1E8E4FBD", "versionEndExcluding": "20.11.0"}], "operator": "OR"}]}], "sourceIdentifier": "support@hackerone.com"}