CVE-2018-18571 describes an Incorrect Access Control vulnerability in Citrix XenMobile Server versions 10.8.0 before Rolling Patch 6 and 10.9.0 before Rolling Patch 3. This critical vulnerability, rated 9.1 CVSS, allows an unauthenticated attacker to remotely impersonate and take actions on behalf of any Mobile Application Management (MAM) enrolled device. While the EPSS score is low and there is no evidence of active exploitation, Metasploit, Nuclei, or ExploitDB modules, the potential for high impact on confidentiality and integrity is significant. Community discussion and media coverage for this CVE are minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
10.8.0CPE matchmatch criteria | cpe:2.3:a:citrix:xenmobile_server:10.8.0:-:*:*:*:*:*:* | ||
10.8.0CPE matchmatch criteria | cpe:2.3:a:citrix:xenmobile_server:10.8.0:rolling_patch1:*:*:*:*:*:* | ||
10.8.0CPE matchmatch criteria | cpe:2.3:a:citrix:xenmobile_server:10.8.0:rolling_patch2:*:*:*:*:*:* | ||
10.8.0CPE matchmatch criteria | cpe:2.3:a:citrix:xenmobile_server:10.8.0:rolling_patch3:*:*:*:*:*:* | ||
10.8.0CPE matchmatch criteria | cpe:2.3:a:citrix:xenmobile_server:10.8.0:rolling_patch4:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.