Answer

Overview

October 6, 2014

The reported vulnerability involves a stored XSS vulnerability present in the calendar feature of Kerio Connect 8.1.
 
An authenticated user triggers the vulnerability by inserting malicious JavaScript code into a web page then, using a shared agenda, executes the code in the context of another user.
 
Reported by Géraud De Drouas from French Network and Information Security Agency (ANSSI).

Impact

Disclosure of sensitive information (session cookie for example).

CVSS Base Score: 5.5

Impact Subscore: 4.9

Exploitability Subscore: 8

Overall CVSS Score: 4.3

CVSS v2 Vector (AV:N/AC:L/Au:S/C:P/I:P/A:N/E:POC/RL:OF/RC:C)

Vulnerable versions

Kerio Connect 8.1.0

Kerio Connect 8.1.1

Kerio Connect 8.1.2

Kerio Connect 8.1.3

 

Technical details

Lack of user input control (CWE-79)