CVE-2020-8253 Auth bypass in Citrix XenMobile Server

What is CVE-2020-8253?

CVE-2020-8253 is a high-severity authentication bypass vulnerability in Citrix XenMobile Server, published on 18 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Improper authentication in Citrix XenMobile Server 10.12 before RP2, Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.10 before RP6 and Citrix XenMobile Server before 10.9 RP5 leads to the ability to access sensitive files.

Weakness: CWE-287

Which versions are affected by CVE-2020-8253?

It affects 1 product.

Products include Citrix Xenmobile Server.

How do I fix CVE-2020-8253?

No fix has been published for CVE-2020-8253 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2020-8253 being exploited?

There is no known exploitation of CVE-2020-8253 in the wild and no public exploit code.

Other vulnerabilities in Citrix XenMobile Server

• CVE-2020-8211 SQL injection in Citrix XenMobile Server Critical 9.8
• CVE-2020-8212 Missing authorization in Citrix XenMobile Server Critical 9.8
• CVE-2018-10648 File upload in n/a Critical 9.8
• CVE-2018-10653 XML external entity in n/a Critical 9.8
• CVE-2018-18571 Auth bypass in n/a Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mgp8-hj77-63qg.