CVE-2018-10654 — Deserialization of Untrusted Data in Citrix Xenmobile Server

CWE-502 — Deserialization of Untrusted Data4 documents3 sources

Severity

8.1HIGHNVD

EPSS

0.4%

top 41.76%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Citrix Xenmobile Server Citrix ADM Citrix Hypervisor +5 more

Timeline

PublishedMay 23

Latest updateMay 14

Description

There is a Hazelcast Library Java Deserialization Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9

Affected Packages8 packages

▶NVDcitrix/xenmobile_server10.7, 10.8+1

▶citrixcitrix/xenserver

▶citrixcitrix/citrix_adm

▶citrixcitrix/netscaler_adc

▶citrixcitrix/citrix_hypervisor

🔴Vulnerability Details

GHSA

GHSA-phhp-5h4r-6w6w: There is a Hazelcast Library Java Deserialization Vulnerability in Citrix XenMobile Server 10↗2022-05-14

▶

📋Vendor Advisories

Citrix

CVE-2018-10654: There is a Hazelcast Library Java Deserialization Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.↗2018-05-23

▶

Citrix

Citrix Security Bulletin CTX234879↗

▶