9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.968 High
EPSS
Percentile
99.7%
Multiple vulnerabilities have been discovered in Citrix Endpoint Management (CEM), also referred to as XenMobile.
These vulnerabilities have the following identifiers:
The following versions of Citrix Endpoint Management (CEM) are affected by critical severity vulnerabilities:
Customers affected by these critical severity vulnerabilities are strongly recommended to update their deployments immediately.
Additionally, the following versions of Citrix Endpoint Management (CEM) are affected by medium and low severity vulnerabilities:
Customers who are only affected by these medium and low severity vulnerabilities are recommended to update their deployments as soon as their patching schedule allows.
Customers using the cloud version of Citrix Endpoint Management are not affected by these vulnerabilities.
The latest Rolling Patches for Citrix Endpoint Management (CEM) can be downloaded from the following locations:
Customers should ensure they are running a supported version and then download and deploy the latest rolling patch to their deployments.
Citrix would like to thank Andrey Medov of Positive Technologies (https://www.ptsecurity.com), Glyn Wintle of Tradecraft (https://www.wearetradecraft.com) and Kristian Bremberg of Detectify for working with us to protect Citrix customers.
Citrix is notifying customers and channel partners about this potential security issue. This article is also available from the Citrix Knowledge Center at _ <http://support.citrix.com/>_.
If you require technical assistance with this issue, please contact Citrix Technical Support. Contact details for Citrix Technical Support are available at _ <https://www.citrix.com/support/open-a-support-case.html>_.
Citrix welcomes input regarding the security of its products and considers any and all potential vulnerabilities seriously. For guidance on how to report security-related issues to Citrix, please see the Citrix Trust Center at <https://www.citrix.com/about/trust-center/vulnerability-process.html>
Date | Change |
---|---|
2020-08-11 | Initial publication |
2020-09-18 | CVE-2020-8253 Added |
CPE | Name | Operator | Version |
---|---|---|---|
xenmobile server | le | 10.12 | |
xenmobile server | le | 10.11 | |
xenmobile server | le | 10.10 | |
xenmobile server | le | 10.9 |
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.968 High
EPSS
Percentile
99.7%