Progress Patches ShareFile Storage Zone Controller Zero-Day
Summary
Progress says an authenticated administrator could use a high-severity path traversal flaw to read files, write content, or enumerate server filesystems. Updates are available; the company reports no indication of customer account or data access.
Key points
- Progress identified a high-severity path traversal vulnerability affecting all 5.x and 6.x versions of ShareFile Storage Zone Controller.
- An authenticated administrative user could read files accessible to the service account, write attacker-controlled content to directories, or enumerate the server filesystem.
- Progress released versions 5.12.5 and 6.0.2 to fix the flaw and urged customers to install them.
- Progress had advised customers to shut down affected Windows servers after receiving a warning of a credible external security threat.
- The company says it has no indication of unauthorized access to ShareFile customer accounts or data and has identified no active threat.
- Progress says a CVE identifier is reserved and will be published in two weeks.
Article Details
- Vulnerability Types
- Path traversal
- Severity
- High
- Affected Versions
- ShareFile Storage Zone Controller 5.x
- ShareFile Storage Zone Controller 6.x
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Shut down affected Storage Zone Controller servers until the security updates are installed.
MITRE ATT&CK
Vendors
Products
ShareFileProgress Software confirmed that a high-severity zero-day path traversal vulnerability forced the emergency shutdown of ShareFile Storage Zone Controllers and has now released patches.ShareFile Storage Zone ControllerThe issue was identified as a high-severity path traversal flaw affecting ShareFile Storage Zone Controller 5.x and 6.x versions.