Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Aug 29, 2019 · Catalog

   Detected

   Citrix StoreFront Server contains an XML External Entity (XXE) processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information.

2. Nov 3, 2021 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. May 3, 2022 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   Citrix StoreFront Server contains an XML External Entity (XXE) processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information.

Affected

• cpe citrix/storefront serverversion unspecified
• vendor Citrix StoreFront Serverversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2019-13608

  Citrix StoreFront Server contains an XML External Entity (XXE) processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information.

  cisa.gov
• CVE.orgVulnerability recordCVE-2019-13608

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2019-13608

  30-day exploitation probability 30.0%

  first.org
• NIST NVDVulnerability recordCVE-2019-13608

  Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.

  nvd.nist.gov

References

• CISA note · nvd.nist.gov
• Mitigation · support.citrix.com
• US Government Resource · cisa.gov