CVE-2024-52875

Katalog CVE

CVSS 8.8 · High EPSS 29,3%

Kerentanan Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') pada gfi kerio control. Skor CVSS 3.1 8.8 (High) menurut mitre.org.

Deskripsi (NVD)

An issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5. The dest GET parameter passed to the /nonauth/addCertException.cs and /nonauth/guestConfirm.cs and /nonauth/expiration.cs pages is not properly sanitized before being used to generate a Location HTTP header in a 302 HTTP response. This can be exploited to perform Open Redirect or HTTP Response Splitting attacks, which in turn lead to Reflected Cross-Site Scripting (XSS). Remote command execution can be achieved by leveraging the upgrade feature in the admin interface.

Rincian

Terbit di NVD

31 Januari 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber mitre.org
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

EPSS (30 hari)

29,3% peluang dieksploitasi; lebih tinggi dari 98,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://karmainsecurity.com/hacking-kerio-control-via-cve-2024-52875 exploit · advisory pihak ketiga
• http://seclists.org/fulldisclosure/2024/Dec/15 exploit · mailing list · advisory pihak ketiga