CVE-2020-8275

Citrix Secure Mail for Android before 20.11.0 suffers from improper access control allowing unauthenticated access to read limited calendar related data stored within Secure Mail. Note that a malicious app would need to be installed on the Android device or a threat actor would need to execute arbitrary code on the Android device.

CVSS v3 4.3 MEDIUM
CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://support.citrix.com/article/CTX286763	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:citrix:secure_mail:*:*:*:*:*:android:*:*

History

No history.

Information

Published : 2021-01-06 21:15

Updated : 2024-02-04 21:23

NVD link : CVE-2020-8275

Mitre link : CVE-2020-8275

CVE.ORG link : CVE-2020-8275

JSON object : View

Products Affected

citrix

secure_mail

CWE

CWE-269

Improper Privilege Management

CWE-284

Improper Access Control

{"id": "CVE-2020-8275", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2021-01-06T21:15:14.520", "references": [{"url": "https://support.citrix.com/article/CTX286763", "tags": ["Vendor Advisory"], "source": "support@hackerone.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-269"}]}, {"type": "Secondary", "source": "support@hackerone.com", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Citrix Secure Mail for Android before 20.11.0 suffers from improper access control allowing unauthenticated access to read limited calendar related data stored within Secure Mail. Note that a malicious app would need to be installed on the Android device or a threat actor would need to execute arbitrary code on the Android device."}, {"lang": "es", "value": "Citrix Secure Mail para Android versiones anteriores a 20.11.0, sufre de un control de acceso inapropiado permitiendo el acceso no autenticado para leer datos limitados relacionados con el calendario almacenados dentro de Secure Mail. Tome en cuenta que una aplicaci\u00f3n maliciosa necesitar\u00eda ser instalada en el dispositivo Android o un actor de amenazas necesitar\u00eda ejecutar c\u00f3digo arbitrario en el dispositivo Android"}], "lastModified": "2021-01-12T16:21:00.993", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:citrix:secure_mail:*:*:*:*:*:android:*:*", "vulnerable": true, "matchCriteriaId": "62E7A966-BD38-419D-8072-806F1E8E4FBD", "versionEndExcluding": "20.11.0"}], "operator": "OR"}]}], "sourceIdentifier": "support@hackerone.com"}