⚠ Exploited in the wild
Exploitation observed in the wild. Not yet on CISA KEV.

CVE-2020-8209 — Path Traversal in Citrix Xenmobile Server

CWE-22 — Path Traversal8 documents7 sources
Severity
7.5HIGHNVD
EPSS
93.0%
top 0.22%
CISA KEV
Not in KEV
Exploit
Exploited in wild
Active exploitation observed
Affected products
4
Citrix Xenmobile ServerCitrix Endpoint ManagementCitrix Xenmobile+1 more
Timeline
PublishedAug 17
Latest updateMay 24

Description

Improper access control in Citrix XenMobile Server 10.12 before RP2, Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.10 before RP6 and Citrix XenMobile Server before 10.9 RP5 and leads to the ability to read arbitrary files.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

🔴Vulnerability Details

2
GHSA
GHSA-fx75-7xmm-5hm3: Improper access control in Citrix XenMobile Server 10↗2022-05-24
▶
VulnCheck
Citrix xenmobile_server Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')↗2020
▶

💥Exploits & PoCs

1
Nuclei
Citrix XenMobile Server - Local File Inclusion
▶

🔍Detection Rules

1
Suricata
ET WEB_SPECIFIC_APPS Citrix XenMobile Server Directory Traversal Attempt Inbound (CVE-2020-8209)↗2020-11-19
▶

📋Vendor Advisories

2
Citrix
Citrix Endpoint Management (CEM) Security Update↗2020-09-18
▶
Citrix
CVE-2020-8209: Improper access control in Citrix XenMobile Server 10.12 before RP2, Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.10 before RP↗2020-08-17
▶

🕵️Threat Intelligence

1
Trendmicro
Patches für Sicherheitslücken↗2020-08-17
▶