The session cookie in MailGates and MailAudit from Openfind does not have the HttpOnly flag enabled, allowing remote attackers to potentially steal the session cookie via XSS.
References
| Link | Resource |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-7927-03837-1.html | Third Party Advisory |
| https://www.twcert.org.tw/en/cp-139-7928-04e8a-2.html | Third Party Advisory |
| https://www.openfind.com.tw/taiwan/download/Openfind_OF-ISAC-24-007.pdf | Exploit |
Configurations
Configuration 1 (hide)
|
History
03 Oct 2024, 18:39
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-732 |
16 Jul 2024, 18:02
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Openfind mailgates
Openfind Openfind mailaudit |
|
| CWE | CWE-79 | |
| CPE | cpe:2.3:a:openfind:mailaudit:*:*:*:*:*:*:*:* cpe:2.3:a:openfind:mailgates:*:*:*:*:*:*:*:* |
|
| References | () https://www.twcert.org.tw/tw/cp-132-7927-03837-1.html - Third Party Advisory | |
| References | () https://www.twcert.org.tw/en/cp-139-7928-04e8a-2.html - Third Party Advisory | |
| References | () https://www.openfind.com.tw/taiwan/download/Openfind_OF-ISAC-24-007.pdf - Exploit | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
15 Jul 2024, 04:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-07-15 04:15
Updated : 2024-10-03 18:39
NVD link : CVE-2024-6739
Mitre link : CVE-2024-6739
JSON object : View
Products Affected
openfind
- mailaudit
- mailgates
CWE
CWE-732
Incorrect Permission Assignment for Critical Resource