The session cookie in MailGates and MailAudit from Openfind does not have the HttpOnly flag enabled, allowing remote attackers to potentially steal the session cookie via XSS.
References
Link | Resource |
---|---|
https://www.openfind.com.tw/taiwan/download/Openfind_OF-ISAC-24-007.pdf | Exploit |
https://www.twcert.org.tw/en/cp-139-7928-04e8a-2.html | Third Party Advisory |
https://www.twcert.org.tw/tw/cp-132-7927-03837-1.html | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
03 Oct 2024, 18:39
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-732 |
16 Jul 2024, 18:02
Type | Values Removed | Values Added |
---|---|---|
First Time |
Openfind mailgates
Openfind Openfind mailaudit |
|
References | () https://www.openfind.com.tw/taiwan/download/Openfind_OF-ISAC-24-007.pdf - Exploit | |
References | () https://www.twcert.org.tw/en/cp-139-7928-04e8a-2.html - Third Party Advisory | |
References | () https://www.twcert.org.tw/tw/cp-132-7927-03837-1.html - Third Party Advisory | |
CWE | CWE-79 | |
CPE | cpe:2.3:a:openfind:mailaudit:*:*:*:*:*:*:*:* cpe:2.3:a:openfind:mailgates:*:*:*:*:*:*:*:* |
|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
Summary |
|
15 Jul 2024, 04:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2024-07-15 04:15
Updated : 2024-10-03 18:39
NVD link : CVE-2024-6739
Mitre link : CVE-2024-6739
CVE.ORG link : CVE-2024-6739
JSON object : View
Products Affected
openfind
- mailaudit
- mailgates