Openfind's Mail2000 has a vulnerability that allows the HttpOnly flag to be bypassed. Unauthenticated remote attackers can exploit this vulnerability using specific JavaScript code to obtain the session cookie with the HttpOnly flag enabled.
References
| Link | Resource |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-7940-0177a-1.html | Third Party Advisory |
| https://www.twcert.org.tw/en/cp-139-7941-b66e7-2.html | Third Party Advisory |
| https://www.openfind.com.tw/taiwan/download/Openfind_OF-ISAC-24-007.pdf | Exploit |
Configurations
Configuration 1 (hide)
|
History
19 Jul 2024, 18:23
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.twcert.org.tw/tw/cp-132-7940-0177a-1.html - Third Party Advisory | |
| References | () https://www.openfind.com.tw/taiwan/download/Openfind_OF-ISAC-24-007.pdf - Exploit | |
| References | () https://www.twcert.org.tw/en/cp-139-7941-b66e7-2.html - Third Party Advisory | |
| CPE | cpe:2.3:a:openfind:mail2000:7.0:*:*:*:*:*:*:* cpe:2.3:a:openfind:mail2000:8.0:*:*:*:*:*:*:* |
|
| CWE | NVD-CWE-noinfo | |
| First Time |
Openfind mail2000
Openfind |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
15 Jul 2024, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-07-15 09:15
Updated : 2024-07-19 18:23
NVD link : CVE-2024-6741
Mitre link : CVE-2024-6741
JSON object : View
Products Affected
openfind
- mail2000
CWE