PT-2020-5827 · Citrix · Citrix Xenmobile Server

Published 2020-08-12 · Updated 2020-08-20 · CVE-2020-8210

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Citrix XenMobile Server versions 10.12 before RP3 Citrix XenMobile Server versions 10.11 before RP6 Citrix XenMobile Server version 10.10 RP6 Citrix XenMobile Server versions prior to 10.9 RP5

Description: The issue is related to insufficient protection of secrets, which discloses credentials of a service account. This could allow a remote attacker to gain unauthorized access to protected information.

Recommendations: For Citrix XenMobile Server version 10.12 before RP3, apply the RP3 patch to resolve the issue. For Citrix XenMobile Server version 10.11 before RP6, apply the RP6 patch to resolve the issue. For Citrix XenMobile Server version 10.10 RP6, upgrade to a version with the necessary security fixes. For Citrix XenMobile Server versions prior to 10.9 RP5, upgrade to version 10.9 RP5 or later to resolve the issue.

Fix

Information Disclosure

Insufficiently Protected Credentials

Weakness Enumeration

CWE-200

CWE-522

Related Identifiers

BDU:2021-01796

CVE-2020-8210

Affected Products

Citrix Xenmobile Server

References · 5

• https://support.citrix.com/article/CTX277457 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01796 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-8210 · Security Note
• https://osv.dev/vulnerability/CVE-2020-8210 · Vendor Advisory
• https://t.me/ckure/5218 · Telegram Post