Description of Problem
Multiple vulnerabilities have been discovered in Citrix Endpoint Management (CEM), also referred to as XenMobile.
These vulnerabilities have the following identifiers:
- CVE-2020-8208
- CVE-2020-8209
- CVE-2020-8210
- CVE-2020-8211
- CVE-2020-8212
- CVE-2020-8253
The following versions of Citrix Endpoint Management (CEM) are affected by critical severity vulnerabilities:
- XenMobile Server 10.12 before RP2
- XenMobile Server 10.11 before RP4
- XenMobile Server 10.10 before RP6
- XenMobile Server before 10.9 RP5
Customers affected by these critical severity vulnerabilities are strongly recommended to update their deployments immediately.
Additionally, the following versions of Citrix Endpoint Management (CEM) are affected by medium and low severity vulnerabilities:
- XenMobile Server 10.12 before RP3
- XenMobile Server 10.11 before RP6
- XenMobile Server 10.10 before RP6
- XenMobile Server before 10.9 RP5
Customers who are only affected by these medium and low severity vulnerabilities are recommended to update their deployments as soon as their patching schedule allows.
Customers using the cloud version of Citrix Endpoint Management are not affected by these vulnerabilities.
What Customers Should Do
The latest Rolling Patches for Citrix Endpoint Management (CEM) can be downloaded from the following locations:
- XenMobile Server 10.12 RP3: https://support.citrix.com/article/CTX277473
- XenMobile Server 10.11 RP6: https://support.citrix.com/article/CTX277698
- XenMobile Server 10.10 RP6: https://support.citrix.com/article/CTX279101
- XenMobile Server 10.9 RP5: https://support.citrix.com/article/CTX279098
Customers should ensure they are running a supported version and then download and deploy the latest rolling patch to their deployments.
Acknowledgements
Citrix would like to thank Andrey Medov of Positive Technologies (https://www.ptsecurity.com), Glyn Wintle of Tradecraft (https://www.wearetradecraft.com) and Kristian Bremberg of Detectify for working with us to protect Citrix customers.
What Citrix Is Doing
Citrix is notifying customers and channel partners about this potential security issue. This article is also available from the Citrix Knowledge Center at http://support.citrix.com/.
Obtaining Support on This Issue
If you require technical assistance with this issue, please contact Citrix Technical Support. Contact details for Citrix Technical Support are available at https://www.citrix.com/support/open-a-support-case.html.
Reporting Security Vulnerabilities
Citrix welcomes input regarding the security of its products and considers any and all potential vulnerabilities seriously. For guidance on how to report security-related issues to Citrix, please see the Citrix Trust Center at https://www.citrix.com/about/trust-center/vulnerability-process.html
Changelog
| Date | Change |
| 2020-08-11 | Initial publication |
| 2020-09-18 | CVE-2020-8253 Added |