CVE-2017-9231

XML external entity (XXE) vulnerability in Citrix XenMobile Server 9.x and 10.x before 10.5 RP3 allows attackers to obtain sensitive information via unspecified vectors.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/98995	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1038704
https://support.citrix.com/article/CTX220138	Vendor Advisory
http://www.securityfocus.com/bid/98995	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1038704
https://support.citrix.com/article/CTX220138	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:citrix:xenmobile_server:9.0:::::::*
	cpe:2.3:o:citrix:xenmobile_server:10.0:::::::*
	cpe:2.3:o:citrix:xenmobile_server:10.1:::::::*
	cpe:2.3:o:citrix:xenmobile_server:10.3:::::::*
	cpe:2.3:o:citrix:xenmobile_server:10.3.5:::::::*
	cpe:2.3:o:citrix:xenmobile_server:10.3.6:::::::*
	cpe:2.3:o:citrix:xenmobile_server:10.4:::::::*
	cpe:2.3:o:citrix:xenmobile_server:10.5:::::::*

History

21 Nov 2024, 03:35

Type	Values Removed	Values Added
References	~~() http://www.securityfocus.com/bid/98995 - Third Party Advisory, VDB Entry~~	() http://www.securityfocus.com/bid/98995 - Third Party Advisory, VDB Entry
References	~~() http://www.securitytracker.com/id/1038704 -~~	() http://www.securitytracker.com/id/1038704 -
References	~~() https://support.citrix.com/article/CTX220138 - Vendor Advisory~~	() https://support.citrix.com/article/CTX220138 - Vendor Advisory

Information

Published : 2017-06-16 22:29

Updated : 2025-04-20 01:37

NVD link : CVE-2017-9231

Mitre link : CVE-2017-9231

CVE.ORG link : CVE-2017-9231

JSON object : View

Products Affected

citrix

xenmobile_server

CWE

CWE-611

Improper Restriction of XML External Entity Reference

{"id": "CVE-2017-9231", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2017-06-16T22:29:00.243", "references": [{"url": "http://www.securityfocus.com/bid/98995", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://www.securitytracker.com/id/1038704", "source": "cve@mitre.org"}, {"url": "https://support.citrix.com/article/CTX220138", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/98995", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id/1038704", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://support.citrix.com/article/CTX220138", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "XML external entity (XXE) vulnerability in Citrix XenMobile Server 9.x and 10.x before 10.5 RP3 allows attackers to obtain sensitive information via unspecified vectors."}, {"lang": "es", "value": "Una vulnerabilidad de tipo XML external entity (XXE) en Citrix XenMobile Server versi\u00f3n 9.x y versi\u00f3n 10.x anterior a 10.5 RP3, permite a los atacantes obtener informaci\u00f3n confidencial por medio de vectores no especificados."}], "lastModified": "2025-04-20T01:37:25.860", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:citrix:xenmobile_server:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EA111D25-3870-427B-B9DF-545CB07CF0E7"}, {"criteria": "cpe:2.3:o:citrix:xenmobile_server:10.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B66150E7-E4C3-4895-B806-FCE001EE0739"}, {"criteria": "cpe:2.3:o:citrix:xenmobile_server:10.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "178F3810-071A-40FF-A22A-D6DB0C53931F"}, {"criteria": "cpe:2.3:o:citrix:xenmobile_server:10.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CFF8A1F0-372E-4A4A-889A-1AF5F287ECC3"}, {"criteria": "cpe:2.3:o:citrix:xenmobile_server:10.3.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1FE08E27-1B91-4187-8F7E-17DE03C94612"}, {"criteria": "cpe:2.3:o:citrix:xenmobile_server:10.3.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E0D2A8B0-6BD3-48FB-AC71-D087D099C458"}, {"criteria": "cpe:2.3:o:citrix:xenmobile_server:10.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "837A66B0-F1DB-4E95-880C-8A7533B0574A"}, {"criteria": "cpe:2.3:o:citrix:xenmobile_server:10.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3ED27536-FB52-4D4A-925C-715511536E6B"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}