Lucene search

K
citrixCitrixCTX277457
HistoryAug 11, 2020 - 4:00 a.m.

Citrix Endpoint Management (CEM) Security Update

2020-08-1104:00:00
support.citrix.com
25

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.968 High

EPSS

Percentile

99.7%

Description of Problem

Multiple vulnerabilities have been discovered in Citrix Endpoint Management (CEM), also referred to as XenMobile.
These vulnerabilities have the following identifiers:

  • CVE-2020-8208
  • CVE-2020-8209
  • CVE-2020-8210
  • CVE-2020-8211
  • CVE-2020-8212
  • CVE-2020-8253

The following versions of Citrix Endpoint Management (CEM) are affected by critical severity vulnerabilities:

  • XenMobile Server 10.12 before RP2
  • XenMobile Server 10.11 before RP4
  • XenMobile Server 10.10 before RP6
  • XenMobile Server before 10.9 RP5

Customers affected by these critical severity vulnerabilities are strongly recommended to update their deployments immediately.

Additionally, the following versions of Citrix Endpoint Management (CEM) are affected by medium and low severity vulnerabilities:

  • XenMobile Server 10.12 before RP3
  • XenMobile Server 10.11 before RP6
  • XenMobile Server 10.10 before RP6
  • XenMobile Server before 10.9 RP5

Customers who are only affected by these medium and low severity vulnerabilities are recommended to update their deployments as soon as their patching schedule allows.

Customers using the cloud version of Citrix Endpoint Management are not affected by these vulnerabilities.

What Customers Should Do

The latest Rolling Patches for Citrix Endpoint Management (CEM) can be downloaded from the following locations:

Customers should ensure they are running a supported version and then download and deploy the latest rolling patch to their deployments.

Acknowledgements

Citrix would like to thank Andrey Medov of Positive Technologies (https://www.ptsecurity.com), Glyn Wintle of Tradecraft (https://www.wearetradecraft.com) and Kristian Bremberg of Detectify for working with us to protect Citrix customers.

What Citrix Is Doing

Citrix is notifying customers and channel partners about this potential security issue. This article is also available from the Citrix Knowledge Center at _ <http://support.citrix.com/&gt;_.

Obtaining Support on This Issue

If you require technical assistance with this issue, please contact Citrix Technical Support. Contact details for Citrix Technical Support are available at _ <https://www.citrix.com/support/open-a-support-case.html&gt;_.

Reporting Security Vulnerabilities

Citrix welcomes input regarding the security of its products and considers any and all potential vulnerabilities seriously. For guidance on how to report security-related issues to Citrix, please see the Citrix Trust Center at <https://www.citrix.com/about/trust-center/vulnerability-process.html&gt;

Changelog

Date Change
2020-08-11 Initial publication
2020-09-18 CVE-2020-8253 Added

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.968 High

EPSS

Percentile

99.7%