Lucene search
TwcertCVE-2024-6740HistoryJul 15, 2024 - 8:15 a.m.
CVE-2024-6740
2024-07-1508:15:03
CWE-79
twcert
web.nvd.nist.gov
35
openfind
mail2000
email attachment
validation
javascript
stored cross-site scripting
CVSS3
6.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
0.001
Percentile
21.0%
Openfind’s Mail2000 does not properly validate email atachments, allowing unauthenticated remote attackers to inject JavaScript code within the attachment and perform Stored Cross-site scripting attacks.
Affected configurations
Node
openfindmail2000Match7.0
ORopenfindmail2000Match8.0
CNA Affected
[
{
"defaultStatus": "unaffected",
"product": "Mail2000 V7.0",
"vendor": "Openfind",
"versions": [
{
"lessThan": "Patch 131",
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mail2000 V8.0",
"vendor": "Openfind",
"versions": [
{
"lessThan": "Patch 044",
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
]Related
vulnrichment
vulnrichment
CVE-2024-6740 Openfind Mail2000 - Stored XSS
2024-07-15 08:00:31
cvelist
cvelist
CVE-2024-6740 Openfind Mail2000 - Stored XSS
2024-07-15 08:00:31
nvd
nvd
CVE-2024-6740
2024-07-15 08:15:03
CVSS3
6.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
0.001
Percentile
21.0%
Related for CVE-2024-6740