CVE-2019-13608
Published 2019-08-29 · Updated 2026-06-17 · Source cve@mitre.org
Summary
CVE-2019-13608 is a high-severity (CVSS 7.5) vulnerability in Citrix StoreFront Server. CISA added it to the Known Exploited Vulnerabilities catalog on November 3, 2021, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by May 3, 2022. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. Citrix has 27 vulnerabilities in the KEV catalog, 7 of them linked to ransomware.
All 27 known-exploited Citrix vulnerabilities →Description
Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA Known-Exploited Vulnerability
Product: Citrix — StoreFront Server
Name: Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability
Date added: 2021-11-03 · Due: 2022-05-03
Required action: Apply updates per vendor instructions.