CVE-2016-6877

CVE-2016-6877 describes a vulnerability in Citrix XenMobile Server before version 10.5.0.24, where a man-in-the-middle attacker could manipulate HTTP Host headers to trigger 302 redirections via a cached page. Rated Medium with a CVSS score of 5.3, exploitation requires high attack complexity and user interaction, potentially leading to high integrity impact but no confidentiality or availability impact. Despite the vendor’s assessment that it’s not a valid vulnerability due to the man-in-the-middle requirement against a TLS session, there is no evidence of active exploitation, public exploit code, or significant community discussion.