High severity · published Aug 29, 2019
CVE-2019-13608
Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability
RansomwareIn wildKEV
7.5
CVSS
30%
EPSS
Yes
On KEV
Description
Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)30.0% · higher than 98% of CVEs
Exploited in the wildYes
CISA KEVListed Nov 3, 2021
Federal remediation dueMay 3, 2022
Ransomware campaign useKnown
Affected products
Which versions
SS
Storefront Server · Citrix
1811 before 1903; before 3.12.4000; before 3.0.8000 · source: NVD, KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-13608
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-13608
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_CONFIRM
https://support.citrix.com/article/CTX251988
More from Storefront Server
6.5
CVE-2020-8200
Improper authentication in Citrix StoreFront Server < 1912.0.1000 allows an attacker who is authenticated on the same Microsoft Active Directory domain as a Citrix StoreFront…
6.1
CVE-2022-27503
Cross-site Scripting (XSS) vulnerability in Citrix StoreFront affects version 1912 before CU5 and version 3.12 before CU9