CVE-2024-52875

🗓️ 31 Jan 2025 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 7 Media mentions👁 138 Views🌐 WEB

GFI Kerio Control versions 9.2.5 to 9.4.5 vulnerable to Open Redirect and XSS attacks.

Reporter	Title	Published	Views	Family All 15
BDU FSTEC	The vulnerability of the Kerio Control network device protection software lies in its inability to neutralize certain special elements, allowing attackers to execute arbitrary code.	23 Dec 202400:00	–	bdu_fstec
Circl	CVE-2024-52875	17 Dec 202414:10	–	circl
CNNVD	GFI Kerio Control 安全漏洞	31 Jan 202500:00	–	cnnvd
Cvelist	CVE-2024-52875	31 Jan 202500:00	–	cvelist
Nuclei	Kerio Control v9.2.5 - CRLF Injection	28 Jun 202615:08	–	nuclei
NVD	CVE-2024-52875	31 Jan 202508:15	–	nvd
OSV	CVE-2024-52875	31 Jan 202508:15	–	osv
Positive Technologies	PT-2024-9739	16 Dec 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-52875	5 Feb 202512:22	–	redhatcve
The Hacker News	⚡ THN Weekly Recap: Top Cybersecurity Threats, Tools and Tips [13 January]	13 Jan 202512:05	–	thn

NVD

Vulners

CNA

Node

gfi kerio_controlRange9.2.5–9.4.5

[
  {
    "defaultStatus": "unknown",
    "product": "Kerio Control",
    "vendor": "GFI",
    "versions": [
      {
        "lessThanOrEqual": "9.4.5",
        "status": "affected",
        "version": "9.2.5",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
karmainsecurity	www.karmainsecurity.com/hacking-kerio-control-via-cve-2024-52875
seclists	www.seclists.org/fulldisclosure/2024/Dec/15

Parameter	Position	Path	Description	CWE
dest	query param	nonauth/addCertException.cs	Open Redirect/HTTP Response Splitting via unsanitized dest parameter in Location header of 302 response	CWE-113
dest	query param	nonauth/guestConfirm.cs	Open Redirect/HTTP Response Splitting via unsanitized dest parameter in Location header of 302 response	CWE-113
dest	query param	nonauth/expiration.cs	Open Redirect/HTTP Response Splitting via unsanitized dest parameter in Location header of 302 response	CWE-113