CVE-2019-13608
Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability
Severity Score
7.5
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
Yes
*KEV
Decision
-
*SSVC
Descriptions
Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.
Citrix StoreFront Server versiones anteriores a 1903, 7.15 LTSR antes del CU4 (3.12.4000) y versión 7.6 LTSR antes del CU8 (3.0.8000), permite ataques de tipo XXE.
Citrix StoreFront Server contains an XML External Entity (XXE) processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2019-07-15 CVE Reserved
- 2019-08-29 CVE Published
- 2021-11-03 Exploited in Wild
- 2022-05-03 KEV Due Date
- 2023-04-28 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- First Exploit
CWE
- CWE-611: Improper Restriction of XML External Entity Reference
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://support.citrix.com/article/CTX251988 | 2019-09-04 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Citrix Search vendor "Citrix" | Storefront Server Search vendor "Citrix" for product "Storefront Server" | < 1903 Search vendor "Citrix" for product "Storefront Server" and version " < 1903" | - |
Affected
| ||||||
| Citrix Search vendor "Citrix" | Storefront Server Search vendor "Citrix" for product "Storefront Server" | < 3.12.4000 Search vendor "Citrix" for product "Storefront Server" and version " < 3.12.4000" | - |
Affected
| ||||||
| Citrix Search vendor "Citrix" | Storefront Server Search vendor "Citrix" for product "Storefront Server" | < 3.0.8000 Search vendor "Citrix" for product "Storefront Server" and version " < 3.0.8000" | - |
Affected
| ||||||