Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2017-7440: Kerio Connect email preview can be tricked into clickjacking

CVE-2017-7440 · published 9 years ago

Summary

Both the Kerio Connect mail server (versions 8.0.0‑9.2.2) and its desktop client (versions 9.2.0‑9.2.2) let a malicious email cause hidden actions when preview is turned on. An attacker could embed a crafted message that makes users unintentionally click hidden buttons or links. Disable email preview or apply the vendor’s update to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
gfi	kerio_connect	>= 8.0.0, <= 9.2.2 `cpe:2.3:a:gfi:kerio_connect::::::::`
gfi	kerio_connect_client	>= 9.2.0, <= 9.2.2 `cpe:2.3:a:gfi:kerio_connect_client::::::::`

Original advisory text

Kerio Connect 8.0.0 through 9.2.2, and Kerio Connect Client desktop application for Windows and Mac 9.2.0 through 9.2.2, when e-mail preview is enabled, allows remote attackers to conduct clickjack...

References

https://www.gfi.com/support/products/Clickjacking-vulnerability-in-Kerio-Connect... Patch Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-1021Improper Restriction of Rendered UI Layers or Frames

Timeline

Published2 May 2017

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2017-7440 · NVD

Track software like this

Free during beta