CVE-2018-18013
First published: Wed Oct 24 2018(Updated: )
* Xen Mobile through 10.8.0 includes a service listening on port 5001 within its firewall that accepts unauthenticated input. If this service is supplied with raw serialised Java objects, it deserialises them back into Java objects in memory, giving rise to a remote code execution vulnerability. NOTE: the vendor disputes that this is a vulnerability, stating it is "already mitigated by the internal firewall that limits access to configuration services to localhost.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Citrix XenMobile Server | <=10.8.0 | |
| <=10.8.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2018-18013?
The severity of CVE-2018-18013 is high with a severity value of 7.8.
How does Xen Mobile through 10.8.0 handle unauthenticated input on port 5001?
Xen Mobile through 10.8.0 includes a service listening on port 5001 within its firewall that accepts unauthenticated input.
What is the vulnerability of CVE-2018-18013?
CVE-2018-18013 is a remote code execution vulnerability that occurs when Xen Mobile deserializes raw serialised Java objects supplied through the service on port 5001.
What is the affected software of CVE-2018-18013?
The affected software is Citrix XenMobile Server with versions up to and including 10.8.0.
Is there a fix for CVE-2018-18013?
At the time of writing, there is no known fix for CVE-2018-18013. It is recommended to follow the mitigation steps provided by the vendor or security advisories.
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/status
- agent/softwarecombine
- agent/description
- agent/event
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- status/disputed
- vendor/citrix
- canonical/citrix xenmobile server
- version/citrix xenmobile server/10.8.0