CVE-2018-18014

* Lack of authentication in Citrix Xen Mobile through 10.8 allows low-privileged local users to execute system commands as root by making requests to private services listening on ports 8000, 30000 and 30001. NOTE: the vendor disputes that this is a vulnerability, stating it is "already mitigated by the internal firewall that limits access to configuration services to localhost.

Score

CVSS 3.0 7.8 High

Status

Modified - cve@mitre.org

Published

2018-10-24

Last modified

2024-08-05

Weaknesses

CWE-287

Affected products

• Xenmobile Server (Citrix)

References

• https://advisories.dxw.com/advisories/xen-mobile-backing-service-allows-unauthenticated-local-users-to-execute-system-c…