GFI USA, LLC vulnerabilities and threats

GFI KerioConnect before version 10.0.8 Patch 2 contains a stored cross-site scripting (XSS) vulnerability in its Webmail component. This flaw allows remote attackers to execute JavaScript in an authenticated user's Webmail session by uploading a specially crafted SVG email attachment that bypasses sanitization of event-handler attributes. Exploitation leverages the temporary-download endpoint's weak Content-Security-Policy sandbox, enabling script execution when the attachment is opened. This can lead to theft of user credentials and mailbox contents. The vulnerability is rated medium severity with a CVSS score of 6.2 and has been observed exploited in the wild by Proofpoint Threat Research. A fix is available in version 10.0.8 Patch 2.