CVE-2018-18571

moderate-risk

Published 2019-06-05

An Incorrect Access Control vulnerability has been identified in Citrix XenMobile Server 10.8.0 before Rolling Patch 6 and 10.9.0 before Rolling Patch 3. An attacker can impersonate and take actions on behalf of any Mobile Application Management (MAM) enrolled device.

Do I need to act?

0.34% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.1/10 Critical

NETWORK / LOW complexity

Affected Products (9)

Xenmobile Server

Affected Vendors

Citrix

References (4)

Third Party Advisory http://www.securityfocus.com/bid/108081

Vendor Advisory https://support.citrix.com/article/CTX247736

Third Party Advisory http://www.securityfocus.com/bid/108081

Vendor Advisory https://support.citrix.com/article/CTX247736

/ 100

moderate-risk

Severity 31/34 · Critical

Exploitability 1/34 · Minimal

Exposure 15/34 · Moderate