PT-2024-1440 · Kaspersky · Kaspersky Security 8.0 For Linux Mail Server

Adrian Tiron + 1 · Published 2024-02-01 · Updated 2024-02-29 · CVE-2024-1619

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kaspersky Security 8.0 for Linux Mail Server

Description The issue allows an attacker to potentially force an administrator to click on a malicious link to perform unauthorized actions. This is due to the lack of measures to neutralize special elements, which can be exploited by a remote attacker.

Recommendations For Kaspersky Security 8.0 for Linux Mail Server, consider disabling any functionality that may lead to administrators clicking on malicious links until a patch is available. Restrict access to potentially vulnerable components to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

BDU:2024-00924

CVE-2024-1619

Affected Products

Kaspersky Security 8.0 For Linux Mail Server

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-1619 · Security Note
• https://osv.dev/vulnerability/CVE-2024-1619 · Vendor Advisory
• https://support.kaspersky.com/vulnerability/list-of-advisories/12430#010224 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-00924 · Security Note
• https://support.kaspersky.com/vulnerability/list-of-advisories/12430#011122 · Note
• https://twitter.com/CVEnew/status/1763133646351876585 · Twitter Post
• https://t.me/cvenotify/72675 · Telegram Post
• https://vuldb.com/ru/?id.255257 · Note
• https://twitter.com/VulmonFeeds/status/1763164249264623953 · Twitter Post