Is CVE-2019-13608 exploited in the wild?

Yes. CVE-2019-13608 is known to be exploited in the wild, first recorded on 3 November 2021. Treat it as urgent.

How severe is CVE-2019-13608?

Critical severity, with a CVSS score of 7.5, published 3 November 2021.

Which products and versions are affected?

Citrix StoreFront Server before 1903; Citrix StoreFront Server 7.15 LTSR before CU4 (3.12.4000); Citrix StoreFront Server 7.6 LTSR before CU8 (3.0.8000).

Is there a fix for CVE-2019-13608?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2019-13608 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2019-13608?

Check whether you run Citrix Storefront Server. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-13608: Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability

CVE-2019-13608 · Severity: critical · CVSS 7.5 · Exploited in the wild · Published 2021-11-03

Citrix StoreFront Server contains an XML External Entity (XXE) processing vulnerability due to improper restriction of XML external entity references. An unauthenticated attacker can exploit this to retrieve sensitive information from the server.

Vendors: Citrix.

Quick answers

Is CVE-2019-13608 exploited in the wild?: Yes. CVE-2019-13608 is known to be exploited in the wild, first recorded on 3 November 2021. Treat it as urgent.
How severe is CVE-2019-13608?: Critical severity, with a CVSS score of 7.5, published 3 November 2021.
Which products and versions are affected?: Citrix StoreFront Server before 1903; Citrix StoreFront Server 7.15 LTSR before CU4 (3.12.4000); Citrix StoreFront Server 7.6 LTSR before CU8 (3.0.8000).
Is there a fix for CVE-2019-13608?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2019-13608 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2019-13608?: Check whether you run Citrix Storefront Server. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Affected products

Citrix StoreFront Server before 1903
Citrix StoreFront Server 7.15 LTSR before CU4 (3.12.4000)
Citrix StoreFront Server 7.6 LTSR before CU8 (3.0.8000)

Timeline

2019-08-29: disclosed: NVD Published Date
2021-11-03: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
2021-11-03: exploited: Confirmed exploited in the wild per CISA KEV catalog entry

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.