CVE-2019-13608
Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability
Published Aug 29, 2019 · updated Jun 16, 2026 · citrix storefront server
Citrix StoreFront Server contains an XML External Entity (XXE) processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information.
Timeline
Detection, updates, and resolution for this record.
Aug 29, 2019 · Catalog
Detected
Citrix StoreFront Server contains an XML External Entity (XXE) processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information.
Nov 3, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
May 3, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Citrix StoreFront Server contains an XML External Entity (XXE) processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information.
Required action
Apply updates per vendor instructions.
CISA due date May 3, 2022
Affected
- cpe citrix/storefront serverversion unspecified
- vendor Citrix StoreFront Serverversion unspecified
Sources
- CISA KEVCVE-2019-13608
Citrix StoreFront Server contains an XML External Entity (XXE) processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information.
cisa.gov - CVE.orgCVE-2019-13608
Official CVE identifier
cve.org - FIRST EPSSCVE-2019-13608
30-day exploitation probability 30.0%
first.org - NIST NVDCVE-2019-13608
Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.
nvd.nist.gov