CVE-2017-7440: Input Validation
Published May 2, 2017
·Updated
Kerio Connect 8.0.0 through 9.2.2, and Kerio Connect Client desktop application for Windows and Mac 9.2.0 through 9.2.2, when e-mail preview is enabled, allows remote attackers to conduct clickjacking attacks via a crafted e-mail message.
Affected Software
42 affected components
Kerio Connect=8.0.0
Kerio Connect=8.0.1
Kerio Connect=8.0.2
Kerio Connect=8.1.0
Kerio Connect=8.1.1
Kerio Connect=8.1.2
Kerio Connect=8.1.3
Kerio Connect=8.2.0
Kerio Connect=8.2.1
Kerio Connect=8.2.2
Kerio Connect=8.2.3
Kerio Connect=8.2.4
Kerio Connect=8.3.0
Kerio Connect=8.3.1
Kerio Connect=8.3.2
Kerio Connect=8.3.3
Kerio Connect=8.3.4
Kerio Connect=8.4.0
Kerio Connect=8.4.1
Kerio Connect=8.4.2
Kerio Connect=8.4.3
Kerio Connect=8.5.0
Kerio Connect=8.5.1
Kerio Connect=8.5.2
Kerio Connect=8.5.3
Kerio Connect=9.0.0
Kerio Connect=9.0.1
Kerio Connect=9.0.2
Kerio Connect=9.0.3
Kerio Connect=9.0.4
Kerio Connect=9.1.0
Kerio Connect=9.1.1
Kerio Connect=9.2.0
Kerio Connect=9.2.1
Kerio Connect=9.2.2
Kerio Connect Client desktop application for Windows and Mac=9.2.0
Kerio Connect Client desktop application for Windows and Mac=9.2.1
Kerio Connect Client desktop application for Windows and Mac=9.2.2
GFI Kerio Connect>=8.0.0<=9.2.2
All of the following
GFI Kerio Connect Client>=9.2.0<=9.2.2
Any of the following
Apple macOS
Microsoft Windows
Remediation
Event History
May 2, 2017
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-7440?
CVE-2017-7440 is classified as a medium severity vulnerability due to its potential for clickjacking attacks.
2
How do I fix CVE-2017-7440?
To mitigate CVE-2017-7440, upgrade Kerio Connect to version 9.2.3 or later.
3
Which versions of Kerio Connect are affected by CVE-2017-7440?
CVE-2017-7440 affects Kerio Connect versions 8.0.0 through 9.2.2.
4
Can remote attackers exploit CVE-2017-7440?
Yes, remote attackers can exploit CVE-2017-7440 to conduct clickjacking attacks via crafted email messages.
5
Is the Kerio Connect Client desktop application affected by CVE-2017-7440?
Yes, the Kerio Connect Client desktop application for Windows and Mac versions 9.2.0 through 9.2.2 is also affected.