CVE-2024-6741

Medium

Description

Openfind's Mail2000 has a vulnerability that allows the HttpOnly flag to be bypassed. Unauthenticated remote attackers can exploit this vulnerability using specific JavaScript code to obtain the session cookie with the HttpOnly flag enabled.

SeverityMedium

CVSS5.8

Exploit probability—

ProductOpenfind Mail2000

PublishedJul 15, 2024

First seenJul 15, 2024

Weakness typeCWE-693CWE-693

How to fix

Vendor advisories

openfind.com.tw/taiwan/download/Openfind_OF-ISAC-24-007.pdf

Affected products

Product	Affected versions	Fixed in
openfind mail2000	7.0, 8.0	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.