Gfi Kerioconnect
Monthly
Local privilege escalation in GFI KerioConnect's KOFF Outlook Connector (Offline Edition) before 10.0.9 Patch 2 lets a non-administrative local user on a Windows host replace the searchd.exe binary used by the bundled KOFFIndexingService, which runs as LocalSystem, gaining NT AUTHORITY\SYSTEM code execution when the service next starts or the machine reboots. The root cause is CWE-276 incorrect default permissions: the installer leaves the product directory writable by the built-in Users group, so the swap requires only file-write access a standard account already has. Requires local access with low privileges (CVSS 4.0 PR:L, AV:L) and an affected KOFF installation; there is no network vector and closing the hole is a matter of upgrading to 10.0.9 Patch 2 or correcting the directory ACLs. No public exploit code has been identified at time of analysis, and the issue is not in CISA KEV.
HTML injection in GFI Kerio Connect Webmail before 10.0.9 Patch 2 allows unauthenticated remote attackers to spoof link destinations or inject arbitrary markup into rendered messages by sending an email whose link text contains quote characters, breaking the auto-formatter out of the href attribute. Exploitation requires the victim to open the crafted message in the Webmail interface, so impact is scoped to the victim's Webmail session rather than server compromise; no public exploit was identified at time of analysis. The issue is moderate priority with a CVSS 4.0 base score of 5.1, and vendor patch 10.0.9 Patch 2 is available.
GFI KerioConnect Webmail before 10.0.8 Patch 2 is affected by stored cross-site scripting in which a crafted SVG email attachment bypasses sanitization of event-handler attributes and executes JavaScript when the victim opens it, with the temporary-download endpoint's insufficient Content-Security-Policy sandbox failing to block script execution. Successful exploitation can steal credentials and mailbox contents from an authenticated Webmail session; the supplied CVE description attributes an exploitation observation to Proofpoint Threat Research, while no CISA KEV status is included in the provided intelligence. The independent assessment rates this as a Medium-severity issue (CVSS 4.0 6.2) because the victim must actively open the attachment and impact is scored against the victim's browser/Webmail session rather than the mail server itself.
Local privilege escalation in GFI KerioConnect's KOFF Outlook Connector (Offline Edition) before 10.0.9 Patch 2 lets a non-administrative local user on a Windows host replace the searchd.exe binary used by the bundled KOFFIndexingService, which runs as LocalSystem, gaining NT AUTHORITY\SYSTEM code execution when the service next starts or the machine reboots. The root cause is CWE-276 incorrect default permissions: the installer leaves the product directory writable by the built-in Users group, so the swap requires only file-write access a standard account already has. Requires local access with low privileges (CVSS 4.0 PR:L, AV:L) and an affected KOFF installation; there is no network vector and closing the hole is a matter of upgrading to 10.0.9 Patch 2 or correcting the directory ACLs. No public exploit code has been identified at time of analysis, and the issue is not in CISA KEV.
HTML injection in GFI Kerio Connect Webmail before 10.0.9 Patch 2 allows unauthenticated remote attackers to spoof link destinations or inject arbitrary markup into rendered messages by sending an email whose link text contains quote characters, breaking the auto-formatter out of the href attribute. Exploitation requires the victim to open the crafted message in the Webmail interface, so impact is scoped to the victim's Webmail session rather than server compromise; no public exploit was identified at time of analysis. The issue is moderate priority with a CVSS 4.0 base score of 5.1, and vendor patch 10.0.9 Patch 2 is available.
GFI KerioConnect Webmail before 10.0.8 Patch 2 is affected by stored cross-site scripting in which a crafted SVG email attachment bypasses sanitization of event-handler attributes and executes JavaScript when the victim opens it, with the temporary-download endpoint's insufficient Content-Security-Policy sandbox failing to block script execution. Successful exploitation can steal credentials and mailbox contents from an authenticated Webmail session; the supplied CVE description attributes an exploitation observation to Proofpoint Threat Research, while no CISA KEV status is included in the provided intelligence. The independent assessment rates this as a Medium-severity issue (CVSS 4.0 6.2) because the victim must actively open the attachment and impact is scored against the victim's browser/Webmail session rather than the mail server itself.