CVE-2021-44520

EUVD-2021-31353
In Citrix XenMobile Server through 10.12 RP9, there is an Authenticated Command Injection vulnerability, leading to remote code execution with root privileges.
Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 94%
Affected Products (NVD)
VendorProductVersion
citrixxenmobile_server
10.13.0
citrixxenmobile_server
10.13.0:rolling_patch_3
citrixxenmobile_server
10.13.0:rolling_patch_4
citrixxenmobile_server
10.13.0:rolling_patch_5
citrixxenmobile_server
10.13.0:rolling_patch_6
citrixxenmobile_server
10.14.0
citrixxenmobile_server
10.14.0:rolling_patch_1
citrixxenmobile_server
10.14.0:rolling_patch_2
citrixxenmobile_server
10.14.0:rolling_patch_3
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://docs.citrix.com/en-us/xenmobile/server/document-history.html
https://gist.github.com/tree-chtsec/766f81e22ae383987d75eedb3b23b709
https://support.citrix.com/article/CTX370551
https://www.chtsecurity.com/news/09be10ae-b50e-46c9-8ce7-2e995fd988fe
https://docs.citrix.com/en-us/xenmobile/server/document-history.html
https://gist.github.com/tree-chtsec/766f81e22ae383987d75eedb3b23b709
https://support.citrix.com/article/CTX370551
https://www.chtsecurity.com/news/09be10ae-b50e-46c9-8ce7-2e995fd988fe