What’s Vulnerable › Vulnerabilities

CVE-2020-8200

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-09-18 · updated 2026-06-17
• Weakness: CWE-287

Description

Improper authentication in Citrix StoreFront Server < 1912.0.1000 allows an attacker who is authenticated on the same Microsoft Active Directory domain as a Citrix StoreFront server to read arbitrary files from that server.

Affected products

• Citrix StoreFront: before 2006; from 3.0 before 3.0.8001; from 3.12 before 3.12.5001; from 1912 before 1912.0.1000 — fixed in 2006, 3.0.8001, 3.12.5001, 1912.0.1000
• Citrix StoreFront: Citrix StoreFront 1912 CU1 (1912.0.1000), Citrix StoreFront 3.12 for 7.15 LTSR CU5 Hotfix (3.12.5001) and Citrix StoreFront 3.0 for 7.6 LTSR CU8 Hotfix (3.0.8001)

How to fix

Upgrade to a fixed version: Citrix StoreFront 2006, 3.0.8001, 3.12.5001, 1912.0.1000. Check the vendor advisory for mitigations.

References

• https://support.citrix.com/article/CTX277455
• https://support.citrix.com/article/CTX277455

Get alerted when CVE-2020-8200 or the next vulnerability affects your stack