What’s Vulnerable › Vulnerabilities
CVE-2020-8274
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 2.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2021-01-06 · updated 2026-06-17
- Weakness: CWE-94
Description
Citrix Secure Mail for Android before 20.11.0 suffers from Improper Control of Generation of Code ('Code Injection') by allowing unauthenticated access to read data stored within Secure Mail. Note that a malicious app would need to be installed on the Android device or a threat actor would need to execute arbitrary code on the Android device.
Affected products
- Citrix Secure Mail for Android: before 20.11.0 — fixed in 20.11.0
- Citrix Secure Mail for Android: Fixed in 20.11.0
How to fix
Upgrade to a fixed version: Citrix Secure Mail for Android 20.11.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2020-8274 or the next vulnerability affects your stack