CVE-2017-7440 — MEDIUM (6.5)

Q: How severe is CVE-2017-7440?

CVE-2017-7440 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2017-7440?

Check the references section above for vendor advisories and patch information. Affected products include: Gfi Kerio Connect, Gfi Kerio Connect Client, Apple Macos, Microsoft Windows.

Vulnerability Description

Kerio Connect 8.0.0 through 9.2.2, and Kerio Connect Client desktop application for Windows and Mac 9.2.0 through 9.2.2, when e-mail preview is enabled, allows remote attackers to conduct clickjacking attacks via a crafted e-mail message.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

NONE

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Gfi	Kerio Connect	>= 8.0.0, <= 9.2.2
Gfi	Kerio Connect Client	>= 9.2.0, <= 9.2.2
Apple	Macos	-
Microsoft	Windows	-

Related Weaknesses (CWE)

CWE-1021

References

https://www.gfi.com/support/products/Clickjacking-vulnerability-in-Kerio-ConnectPatchVendor Advisory
https://www.gfi.com/support/products/Clickjacking-vulnerability-in-Kerio-ConnectPatchVendor Advisory

FAQ

What is CVE-2017-7440?

CVE-2017-7440 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Kerio Connect 8.0.0 through 9.2.2, and Kerio Connect Client desktop application for Windows and Mac 9.2.0 through 9.2.2, when e-mail preview is enabled, allows remote attackers to conduct clickjacking...

How severe is CVE-2017-7440?

CVE-2017-7440 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2017-7440?

Check the references section above for vendor advisories and patch information. Affected products include: Gfi Kerio Connect, Gfi Kerio Connect Client, Apple Macos, Microsoft Windows.