Xen Mobile contains a vulnerable version of Hazelcast, remote code execution via object serialisation

Vulnerability

Last revised: March 26, 2018

Xen Mobile runs, inside its firewall, a vulnerable version of a Hazelcast server.

Current state: Fixed

You can read more about CVSS base scores on Wikipedia or in the CVSS specification.

Hazelcast is an in-memory data grid service used by Xen Mobile. It contains a known vulnerability allowing an attacker to execute code remotely. An attacker able to make requests within the firewall would be able to use this vulnerability to execute arbitrary code.

2018-03-28 – Reported to Citrix and acknowledged immediately