CVE-2021-44520: Command Injection
Published Apr 12, 2022
·Updated
In Citrix XenMobile Server through 10.12 RP9, there is an Authenticated Command Injection vulnerability, leading to remote code execution with root privileges.
Affected Software
9 affected components
Citrix XenMobile Server=10.13.0
Citrix XenMobile Server=10.13.0-rolling_patch_3
Citrix XenMobile Server=10.13.0-rolling_patch_4
Citrix XenMobile Server=10.13.0-rolling_patch_5
Citrix XenMobile Server=10.13.0-rolling_patch_6
Citrix XenMobile Server=10.14.0
Citrix XenMobile Server=10.14.0-rolling_patch_1
Citrix XenMobile Server=10.14.0-rolling_patch_2
Citrix XenMobile Server=10.14.0-rolling_patch_3
Event History
Apr 12, 2022
CVE Published
via MITRE·11:21 PM
Data Sourced
via MITRE·11:21 PM
Description
Frequently Asked Questions
1
What is CVE-2021-44520?
CVE-2021-44520 is an Authenticated Command Injection vulnerability in Citrix XenMobile Server through 10.12 RP9.
2
What is the severity of CVE-2021-44520?
CVE-2021-44520 has a severity score of 8.8 (critical).
3
How does CVE-2021-44520 lead to remote code execution?
CVE-2021-44520 allows an attacker to execute arbitrary commands with root privileges through the vulnerable Citrix XenMobile Server.
4
How can I fix CVE-2021-44520?
To mitigate CVE-2021-44520, update Citrix XenMobile Server to version 10.13.0 or higher.
5
Where can I find more information about CVE-2021-44520?
You can find more information about CVE-2021-44520 in the Citrix XenMobile Server document history, a GitHub Gist, and a support article on the Citrix website.