CVE-2019-13608

Citrix StoreFront Server had an unauthenticated XXE vulnerability actively exploited by ransomware actors, allowing data retrieval.

An unauthenticated attacker could exploit a StoreFront Server XXE vulnerability to retrieve sensitive information, potentially leading to data breaches and compliance failures (NIST 800-171 controls 3.1.1, 3.1.2). DIB organizations using StoreFront must immediately patch and review access controls.

Shame score — The vulnerability's exploitation by ransomware and lack of authentication requirement highlight a significant negligence in secure coding practices.