Description (CNA)
In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyService to consume attacker-controlled metadata and content. Exploitation requires control over copy queue work and a race condition.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Progress / ShareFile Storage Zones Controller | affected 0 through 5.12.6 |
CWE
CWE-918, CWE-321, CWE-362
References
- https://docs.sharefile.com/en-us/sharefile/storage-zones-controller/5-0/security-vulnerability-sep26
ADP enrichment
No English description supplied.
No references supplied.