PT-2017-17737 · Kerio+2 · Kerio Connect Client+3

CVE-2017-7440 · Publicado 2017-05-02 · Atualizado 2024-01-26

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Kerio Connect versions 8.0.0 through 9.2.2 Kerio Connect Client desktop application for Windows and Mac versions 9.2.0 through 9.2.2

Description The issue allows remote attackers to conduct clickjacking attacks via a crafted e-mail message when e-mail preview is enabled.

Recommendations For Kerio Connect versions 8.0.0 through 9.2.2, consider disabling e-mail preview to prevent clickjacking attacks. For Kerio Connect Client desktop application for Windows and Mac versions 9.2.0 through 9.2.2, consider disabling e-mail preview to prevent clickjacking attacks.

Correção

Clickjacking

Enumeração de Fraquezas

CWE-1021

Identificadores relacionados

CVE-2017-7440

Produtos afetados

Kerio Connect

Kerio Connect Client

Mac

Windows

Referências · 4

• https://osv.dev/vulnerability/CVE-2017-7440 · Aviso do Fabricante
• https://t.me/cvenotify/68918 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2017-7440 · Nota de Segurança
• https://gfi.com/support/products/Clickjacking-vulnerability-in-Kerio-Connect-8-and-9-CVE-2017-7440 · Aviso do Fabricante