CVE-2019-13608 Citrix StoreFront Server XML External Entity (XXE) Processing

Exploited in the wild High 7.5 Published 29 Aug 2019 Updated 21 Oct 2025

An attacker can exploit an XML External Entity vulnerability in Citrix StoreFront Server to read sensitive files or cause denial of service.

Exploited in the wild: Since 3 Nov 2021
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-13608?

CVE-2019-13608 is a high-severity vulnerability in n/a, published on 29 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.

Weakness: CWE-611

Which versions are affected by CVE-2019-13608?

It affects 1 product.

Products include Citrix Storefront Server.

How do I fix CVE-2019-13608?

No fix has been published for CVE-2019-13608 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 3 May 2022.

Is CVE-2019-13608 being exploited?

Yes. Attackers have exploited CVE-2019-13608 in the wild since at least 3 Nov 2021, including in ransomware campaigns.

Public exploit code: 1 Nuclei template.

Sources

Also known as GHSA-22h8-5mmq-pgx3.