PT-2019-6105 · Citrix · Citrix Storefront Server

Published 2019-08-20 · Updated 2025-11-06 · CVE-2019-13608

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Citrix StoreFront Server versions prior to 1903 Citrix StoreFront Server 7.15 LTSR versions prior to CU4 (3.12.4000) Citrix StoreFront Server 7.6 LTSR versions prior to CU8 (3.0.8000)

Description The issue is related to incorrect restriction of XML external entity references, allowing for XXE attacks. This can enable a remote attacker to conduct XXE attacks.

Recommendations For versions prior to 1903, update to version 1903 or later. For 7.15 LTSR versions prior to CU4 (3.12.4000), apply CU4 (3.12.4000) or later. For 7.6 LTSR versions prior to CU8 (3.0.8000), apply CU8 (3.0.8000) or later.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2021-05513

CVE-2019-13608

Affected Products

Citrix Storefront Server

References · 9

• https://bdu.fstec.ru/vul/2021-05513 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-13608 · Security Note
• https://nvd.nist.gov/vuln/detail/cve-2019-13608 · Security Note
• https://osv.dev/vulnerability/CVE-2019-13608 · Vendor Advisory
• https://support.citrix.com/article/CTX251988 · Vendor Advisory
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-13608 · Note
• https://t.me/cveNotify/141934 · Telegram Post
• https://t.me/cvenotify/109980 · Telegram Post
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note