CVE-2019-13608 is a high-severity XML External Entity (XXE) vulnerability affecting Citrix StoreFront Server versions before 1903, 7.15 LTSR before CU4, and 7.6 LTSR before CU8. This flaw allows unauthenticated attackers to remotely exploit the server with low complexity, potentially leading to significant information disclosure. The vulnerability is actively exploited in the wild, including in known ransomware campaigns, and has garnered considerable community discussion, though no public Metasploit or ExploitDB modules are currently available.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 1811, < 1903CPE matchmatch criteria | cpe:2.3:a:citrix:storefront_server:*:*:*:*:*:*:*:* | ||
< 3.12.4000CPE matchmatch criteria | cpe:2.3:a:citrix:storefront_server:*:*:*:*:*:*:*:* | ||
< 3.0.8000CPE matchmatch criteria | cpe:2.3:a:citrix:storefront_server:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.