CVE-2018-18013 - CVE House
Back to Database
Status published High CVE-2018-18013

* Xen Mobile through 10.8.0 includes a service listening on...

Vulnerability Description

* Xen Mobile through 10.8.0 includes a service listening on port 5001 within its firewall that accepts unauthenticated input. If this service is supplied with raw serialised Java objects, it deserialises them back into Java objects in memory, giving rise to a remote code execution vulnerability. NOTE: the vendor disputes that this is a vulnerability, stating it is "already mitigated by the internal firewall that limits access to configuration services to localhost.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-18013

Credits & Attribution

No credits recorded in the NVD database.

References

More from citrix

View All →
CVE-2022-26151
Citrix XenMobile Server 10.12 through RP11, 10.13 through RP7, and...
High 7.2
CVE-2021-44520
In Citrix XenMobile Server through 10.12 RP9, there is an...
High 8.8
CVE-2021-44519
In Citrix XenMobile Server through 10.12 RP9, there is an...
High 8.8
CVE-2020-8983
An arbitrary file write issue exists in all versions of...
High 7.5
CVE-2020-8982
An unauthenticated arbitrary file read issue exists in all versions...
High 7.5

Affected Vendor

Affected Software

xenmobile server
Vulnerable Versions:
0

Timeline

Official Publish: October 24th, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.