CVE-2016-6877
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Citrix XenMobile Server before 10.5.0.24 allows man-in-the-middle attackers to trigger HTTP 302 redirections via vectors involving the HTTP Host header and a cached page. NOTE: the vendor reports "our internal analysis of this issue concluded that this was not a valid vulnerability" because an exploitation scenario would involve a man-in-the-middle attack against a TLS session
**EN DISPUTA** Citrix XenMobile Server en versiones anteriores a la 10.5.0.24 permite a atacantes man-in-the-middle lanzar redirecciones HTTP 302 a través de vectores relacionados con la cabecera HTTP Host y una página cacheada. NOTA: El fabricante informa "nuestro análisis interno de este problema concluye en que esto no fue una vulnerabilidad válida" porque un escenario donde se explote implica un ataque man-in-the-middle contra una sesión TLS.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2016-08-18 CVE Reserved
- 2017-05-05 CVE Published
- 2023-03-15 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-20: Improper Input Validation
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/98341 | Third Party Advisory | |
| https://www.solutionary.com/threat-intelligence/vulnerability-disclosures/2017/03/citrix-xenmobile-server | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Citrix Search vendor "Citrix" | Xenmobile Server Search vendor "Citrix" for product "Xenmobile Server" | <= 10.3.6.310 Search vendor "Citrix" for product "Xenmobile Server" and version " <= 10.3.6.310" | - |
Affected
| ||||||