Skip to main content
IMMUNITYSEC

CVE-2019-13608

7.5
HIGH
CVSS 3.1
EPSS 30.0% · 98th pctCISA KEV · Exploited in the wild
2019-08-29•Updated 2025-10-21•KEV 2021-11-03
CISA Known Exploited Vulnerabilities

Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV
2021-11-03
Remediation due
2022-05-03
Ransomware
Known use

Required action
Apply updates per vendor instructions.

CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2019-13608

Description

Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.

Severity

CVSS 3.1 · CISA7.5 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
SSVC · CISA-ADP
Exploitationactive
Automatableyes
Technical impactpartial

Affected Products

VendorProductAffected versions
--
n/a

References

1 Links

Record Details

Published
2019-08-29
Last updated
2025-10-21
Assigner (CNA)
mitre
Credited to
-

More from Citrix

All Citrix CVEs→
CVE-2019-197819.8 CRITICAL

Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability

KEVEPSS 100.0%2019-12-27
CVE-2023-49669.4 CRITICAL

Unauthenticated sensitive information disclosure

CitrixKEVEPSS 100.0%2023-10-10
CVE-2025-57779.3 CRITICAL

NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread

NetScalerKEVEPSS 100.0%2025-06-17
CVE-2023-35199.8 CRITICAL

Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability

CitrixKEVEPSS 99.7%2023-07-19

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.