CVE-2024-52875

🗓️ 31 Jan 2025 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 7 Media mentions👁 200 Views🌐 WEB

GFI Kerio Control versions 9.2.5 to 9.4.5 vulnerable to Open Redirect and XSS attacks.

Reporter	Title	Published	Views	Family All 17
BDU FSTEC	Kerio Control Code Execution	23 Dec 202400:00	–	bdu_fstec
Circl	CVE-2024-52875	17 Dec 202414:10	–	circl
CNNVD	GFI Kerio Control security vulnerabilities	31 Jan 202500:00	–	cnnvd
Cvelist	CVE-2024-52875	31 Jan 202500:00	–	cvelist
KittySploit	Kerio Control v9.2.5 - CRLF Injection Detection	28 Jul 202611:27	–	kittysploit
Nuclei	Kerio Control v9.2.5 - CRLF Injection	1 Nov 202602:03	–	nuclei
NVD	CVE-2024-52875	31 Jan 202508:15	–	nvd
osv_cve	CVE-2024-52875	31 Jan 202508:15	–	osv_cve
Positive Technologies	PT-2024-9739	16 Dec 202400:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2024-52875: Improper Neutralization of CRLF Sequences in HTTP Headers	31 Jan 202500:00	–	rapid7

NVD

Vulners

CNA

Node

gfi kerio_controlRange9.2.5–9.4.5

[
  {
    "defaultStatus": "unknown",
    "product": "Kerio Control",
    "vendor": "GFI",
    "versions": [
      {
        "lessThanOrEqual": "9.4.5",
        "status": "affected",
        "version": "9.2.5",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
karmainsecurity	www.karmainsecurity.com/hacking-kerio-control-via-cve-2024-52875
seclists	www.seclists.org/fulldisclosure/2024/Dec/15

Parameter	Position	Path	Description	CWE
dest	query param	/nonauth/addCertException.cs	The dest parameter is not properly sanitized before being used to generate a Location HTTP header, leading to Open Redirect, HTTP Response Splitting, or Reflected XSS.	CWE-113
dest	query param	/nonauth/guestConfirm.cs	The dest parameter is not properly sanitized before being used to generate a Location HTTP header, leading to Open Redirect, HTTP Response Splitting, or Reflected XSS.	CWE-113
dest	query param	/nonauth/expiration.cs	The dest parameter is not properly sanitized before being used to generate a Location HTTP header, leading to Open Redirect, HTTP Response Splitting, or Reflected XSS.	CWE-113