CVE-2018-18014: citrix xenmobile_server Improper Authentication

Vulnerability summary

CVE-2018-18014 is a high (CVSS 7.8) Improper Authentication vulnerability in citrix xenmobile_server. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 40.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 24-10-2018
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

* Lack of authentication in Citrix Xen Mobile through 10.8 allows low-privileged local users to execute system commands as root by making requests to private services listening on ports 8000, 30000 and 30001. NOTE: the vendor disputes that this is a vulnerability, stating it is "already mitigated by the internal firewall that limits access to configuration services to localhost.

• CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.