A DOM based XSS in GFI Kerio Control v9.3.0 allows embedding of malicious code and manipulating the login page to send back a victim's cleartext credentials to an attacker via a login/?reason=failure&NTLM= URI.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/154678/GFI-Kerio-Control-9.3.0-Cross-Site-Scripting.html | Exploit Third Party Advisory |
| http://seclists.org/fulldisclosure/2019/Sep/35 | Exploit Mailing List Third Party Advisory |
| https://twitter.com/haxel0rd/status/1174279811751174144 | Exploit Third Party Advisory |
| https://www.youtube.com/watch?v=ZqqR89vzZ_I | Exploit Third Party Advisory |
| http://packetstormsecurity.com/files/154678/GFI-Kerio-Control-9.3.0-Cross-Site-Scripting.html | Exploit Third Party Advisory |
| http://seclists.org/fulldisclosure/2019/Sep/35 | Exploit Mailing List Third Party Advisory |
| https://twitter.com/haxel0rd/status/1174279811751174144 | Exploit Third Party Advisory |
| https://www.youtube.com/watch?v=ZqqR89vzZ_I | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 04:30
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://packetstormsecurity.com/files/154678/GFI-Kerio-Control-9.3.0-Cross-Site-Scripting.html - Exploit, Third Party Advisory | |
| References | () http://seclists.org/fulldisclosure/2019/Sep/35 - Exploit, Mailing List, Third Party Advisory | |
| References | () https://twitter.com/haxel0rd/status/1174279811751174144 - Exploit, Third Party Advisory | |
| References | () https://www.youtube.com/watch?v=ZqqR89vzZ_I - Exploit, Third Party Advisory |
Information
Published : 2019-09-30 13:15
Updated : 2024-11-21 04:30
NVD link : CVE-2019-16414
Mitre link : CVE-2019-16414
CVE.ORG link : CVE-2019-16414
JSON object : View
Products Affected
gfi
- kerio_control
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')