CVE-2024-52875

🗓️ 31 Jan 2025 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 7 Media mentions👁 121 Views🌐 WEB

GFI Kerio Control versions 9.2.5 to 9.4.5 vulnerable to Open Redirect and XSS attacks.

Reporter	Title	Published	Views	Family All 14
Circl	CVE-2024-52875	17 Dec 202414:10	–	circl
CNNVD	GFI Kerio Control 安全漏洞	31 Jan 202500:00	–	cnnvd
Cvelist	CVE-2024-52875	31 Jan 202500:00	–	cvelist
Nuclei	Kerio Control v9.2.5 - CRLF Injection	6 Jun 202603:01	–	nuclei
NVD	CVE-2024-52875	31 Jan 202508:15	–	nvd
OSV	CVE-2024-52875	31 Jan 202508:15	–	osv
Positive Technologies	PT-2024-9739	16 Dec 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-52875	5 Feb 202512:22	–	redhatcve
The Hacker News	⚡ THN Weekly Recap: Top Cybersecurity Threats, Tools and Tips [13 January]	13 Jan 202512:05	–	thn
The Hacker News	⚡ THN Weekly Recap: Top Cybersecurity Threats, Tools and Tips	23 Dec 202412:14	–	thn

NVD

Vulners

CNA

Node

gfi kerio_controlRange9.2.5–9.4.5

[
  {
    "defaultStatus": "unknown",
    "product": "Kerio Control",
    "vendor": "GFI",
    "versions": [
      {
        "lessThanOrEqual": "9.4.5",
        "status": "affected",
        "version": "9.2.5",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
karmainsecurity	www.karmainsecurity.com/hacking-kerio-control-via-cve-2024-52875
seclists	www.seclists.org/fulldisclosure/2024/Dec/15

Parameter	Position	Path	Description	CWE
dest	query param	/nonauth/addCertException.cs	Open Redirect/HTTP Response Splitting via unsanitized dest param used to craft Location header in 302 response.	CWE-113
dest	query param	/nonauth/guestConfirm.cs	Open Redirect/HTTP Response Splitting via unsanitized dest param used to craft Location header in 302 response.	CWE-113
dest	query param	/nonauth/expiration.cs	Open Redirect/HTTP Response Splitting via unsanitized dest param used to craft Location header in 302 response.	CWE-113