ID:10992 - Exploit for HTTP response splitting in Kerio Control - CVE-2024-52875

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to perform HTTP splitting attacks.

The vulnerability exists due to software does not correclty process CRLF character sequences. A remote attacker can send specially crafted request containing CRLF sequence and make the application to send a split HTTP response.

Successful exploitation of the vulnerability may allow an attacker perform cache poisoning attack.

Remediation