CVE-2019-7218

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

Citrix ShareFile before 19.23 allows a downgrade from two-factor authentication to one-factor authentication. An attacker with access to the offline victim's otp physical token or virtual app (like google authenticator) is able to bypass the first authentication phase (username/password mechanism) and log-in using username/otp combination only (phase 2 of 2FA).

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.sk-it.com/en/cve.htmlExploit, Third Party Advisory
http://www.sk-it.com/en/cve.htmlExploit, Third Party Advisory

Timeline

Published: May 13, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-72196.1Unauthenticated reflected cross-site scripting (XSS) exists in Zarafa Webapp 2.0.1.47791 and earlier. NOTE: this is a discontinued product. CVE-2019-72206.1X-Cart V5 is vulnerable to XSS via the CategoryFilter2 parameter.CVE-2019-72217.8The KVM implementation in the Linux kernel through 4.20.5 has a Use-after-Free.CVE-2019-72225.5The KVM implementation in the Linux kernel through 4.20.5 has an Information Leak.CVE-2019-72235.4InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoice_password parameter, aka the "PDF password" field to the "Create CVE-2019-72258.8The ABB HMI components implement hidden administrative accounts that are used during the provisioning phase of the HMI interface. These cred CVE-2019-72268.8The ABB IDAL HTTP server CGI interface contains a URL that allows an unauthenticated attacker to bypass authentication and gain access to pr CVE-2019-72277.3In the ABB IDAL FTP server, an authenticated attacker can traverse to arbitrary directories on the hard disk with "CWD ../" and then use the CVE-2019-72288.8The ABB IDAL HTTP server mishandles format strings in a username or cookie during the authentication process. Attempting to authenticate wit CVE-2019-72298.3The ABB CP635 HMI uses two different transmission methods to upgrade its firmware and its software components: "Utilization of USB/SD Card t CVE-2019-72308.8The ABB IDAL FTP server mishandles format strings in a username during the authentication process. Attempting to authenticate with the usern CVE-2019-72315.7The ABB IDAL FTP server is vulnerable to a buffer overflow when a long string is sent by an authenticated attacker. This overflow is handled