PT-2021-7039 · Citrix · Citrix Xenmobile Server

Tsungshu Chiu · Published 2021-04-12 · Updated 2022-12-03 · CVE-2021-44519

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Citrix XenMobile Server versions through 10.12 RP9

Description The issue exists due to incorrect restriction of the path name to a directory with limited access. This can allow a remote attacker to execute arbitrary code. The vulnerability is described as an Authenticated Directory Traversal vulnerability, leading to remote code execution.

Recommendations For versions through 10.12 RP9, update to a version that contains a fix for this issue to prevent remote code execution. As a temporary workaround, consider restricting access to sensitive directories to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2022-03025

CVE-2021-44519

Affected Products

Citrix Xenmobile Server

References · 10

• https://bdu.fstec.ru/vul/2022-03025 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-44519 · Security Note
• https://docs.citrix.com/en-us/xenmobile/server/document-history.html · Vendor Advisory
• https://support.citrix.com/article/CTX370551 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-44519 · Vendor Advisory
• https://gist.github.com/tree-chtsec/30932b9c94b8c7e4209d22b8b52d597f · Note
• https://chtsecurity.com/news/09be10ae-b50e-46c9-8ce7-2e995fd988fe · Note
• https://t.me/cvenotify/39017 · Telegram Post
• https://t.me/cibsecurity/41102 · Telegram Post
• https://oracle.com/security-alerts/cpuapr2022.html · Note