CVE-2018-18013

Severity Score

7.8

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

* Xen Mobile through 10.8.0 includes a service listening on port 5001 within its firewall that accepts unauthenticated input. If this service is supplied with raw serialised Java objects, it deserialises them back into Java objects in memory, giving rise to a remote code execution vulnerability. NOTE: the vendor disputes that this is a vulnerability, stating it is "already mitigated by the internal firewall that limits access to configuration services to localhost.

** EN DISPUTA ** Xen Mobile hasta la versión 10.8.0 incluye un servicio en escucha en el puerto 5001 en su firewall que acepta entradas no autenticadas. Si el servicio se proporciona con objetos Java serializados en bruto, los vuelve a deserializar en objetos Java en la memoria, lo que provoca una vulnerabilidad de ejecución remota de código. NOTA: el fabricante discute que esto sea una vulnerabilidad, indicando que "ya ha sido mitigado por el firewall interno que limita el acceso a los servicios de configuración del localhost".

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2018-10-05 CVE Reserved
2018-10-24 CVE Published
2024-08-05 CVE Updated
2024-08-05 First Exploit
2024-11-08 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-502: Deserialization of Untrusted Data

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC
https://advisories.dxw.com/advisories/xen-mobile-vulnerable-to-code-execution-via-object-serialisation	2024-08-05

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Citrix Search vendor "Citrix"		Xenmobile Server Search vendor "Citrix" for product "Xenmobile Server"				<= 10.8.0 Search vendor "Citrix" for product "Xenmobile Server" and version " <= 10.8.0"		-		Affected