CVE-2024-6741

Openfind Mail2000 - HttpOnly flag bypass

State: Published
Severity: 5.8 Medium
Published: Jul 15, 2024
Updated: Aug 1, 2024
Reserved: Jul 15, 2024

Description

Openfind's Mail2000 has a vulnerability that allows the HttpOnly flag to be bypassed. Unauthenticated remote attackers can exploit this vulnerability using specific JavaScript code to obtain the session cookie with the HttpOnly flag enabled.

Scores

CVSS	Score	Vector	Source
3.1	5.8 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N	twcert

Weaknesses

CWE-693 Protection Mechanism Failure

Affected Products

Product	Versions
Mail2000 V7.0Openfind	all to before Patch 131Affected
Mail2000 V8.0Openfind	all to before Patch 044Affected

References

https://www.twcert.org.tw/tw/cp-132-7940-0177a-1.htmlthird-party-advisory
https://www.twcert.org.tw/en/cp-139-7941-b66e7-2.htmlthird-party-advisory
https://www.openfind.com.tw/taiwan/download/Openfind_OF-ISAC-24-007.pdfvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.