CVE-2024-52875 - CVE House
Back to Database
Status published High CVE-2024-52875

An issue was discovered in GFI Kerio Control 9.2.5 through...

Vulnerability Description

An issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5. The dest GET parameter passed to the /nonauth/addCertException.cs and /nonauth/guestConfirm.cs and /nonauth/expiration.cs pages is not properly sanitized before being used to generate a Location HTTP header in a 302 HTTP response. This can be exploited to perform Open Redirect or HTTP Response Splitting attacks, which in turn lead to Reflected Cross-Site Scripting (XSS). Remote command execution can be achieved by leveraging the upgrade feature in the admin interface.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-52875

Credits & Attribution

No credits recorded in the NVD database.

References

More from GFI

View All →
CVE-2025-35940
Hard-coded ArchiverSpaApi JWT Signing Key
High 8.1
CVE-2025-34491
GFI MailEssentials < 21.8 MultiNode Insecure Deserialization
High 8.8
CVE-2025-34490
GFI MailEssentials < 21.8 XXE Arbitrary File Read
Medium 6.5
CVE-2025-34489
GFI MailEssentials < 21.8 Local Privilege Escalation
High 7.8
CVE-2025-2977
GFI KerioConnect PDF File cross site scripting
Medium 5.1

Affected Vendor

Affected Software

Kerio Control
Vulnerable Versions:
9.2.5

Timeline

Official Publish: January 31st, 2025
Last Modified: February 12th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-113

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.