CVE-2016-6877
published 2017-05-05CVE-2016-6877: Citrix XenMobile Server before 10.5.0.24 allows man-in-the-middle attackers to trigger HTTP 302 redirections via vectors involving the HTTP Host header and a…
PriorityP423medium5.3CVSS 3.0
AVNACHPRNUIRSUCNIHAN
EPSS
1.27%
66.3th percentile
Citrix XenMobile Server before 10.5.0.24 allows man-in-the-middle attackers to trigger HTTP 302 redirections via vectors involving the HTTP Host header and a cached page. NOTE: the vendor reports "our internal analysis of this issue concluded that this was not a valid vulnerability" because an exploitation scenario would involve a man-in-the-middle attack against a TLS session
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| citrix | xenmobile_server | <= 10.3.6.310 | — |
CVSS provenance
nvdv3.05.3MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
nvdv2.02.6LOWAV:N/AC:H/Au:N/C:N/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Citrix
CVE-2016-6877: Citrix XenMobile Server before 10.5.0.24 allows man-in-the-middle attackers to trigger HTTP 302 redirections via vectors involving the HTTP Host heade
vendor_citrix·2017-05-05·CVSS 5.3
CVE-2016-6877 [MEDIUM] CWE-20 CVE-2016-6877: Citrix XenMobile Server before 10.5.0.24 allows man-in-the-middle attackers to trigger HTTP 302 redirections via vectors involving the HTTP Host heade
CVE-2016-6877: Citrix XenMobile Server before 10.5.0.24 allows man-in-the-middle attackers to trigger HTTP 302 redirections via vectors involving the HTTP Host header and a cached page. NOTE: the vendor reports "our internal analysis of this issue concluded that this was not a valid vulnerability" because an exploitation scenario would involve a man-in-the-middle attack against a TLS session
GHSA
GHSA-g7jr-3gjx-fr4f: ** DISPUTED ** Citrix XenMobile Server before 10
ghsa_unreviewed·2022-05-17
CVE-2016-6877 [MEDIUM] CWE-20 GHSA-g7jr-3gjx-fr4f: ** DISPUTED ** Citrix XenMobile Server before 10
** DISPUTED ** Citrix XenMobile Server before 10.5.0.24 allows man-in-the-middle attackers to trigger HTTP 302 redirections via vectors involving the HTTP Host header and a cached page. NOTE: the vendor reports "our internal analysis of this issue concluded that this was not a valid vulnerability" because an exploitation scenario would involve a man-in-the-middle attack against a TLS session.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2017-05-05
Published