Lucene search

[email protected]NVD:CVE-2024-6739

HistoryJul 15, 2024 - 4:15 a.m.

CVE-2024-6739

2024-07-1504:15:02

CWE-1004

CWE-79

[email protected]

web.nvd.nist.gov

mailgates

mailaudit

session cookie

vulnerability

remote attackers

xss

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

21.1%

JSON

The session cookie in MailGates and MailAudit from Openfind does not have the HttpOnly flag enabled, allowing remote attackers to potentially steal the session cookie via XSS.

Affected configurations

Nvd

Node

openfindmailauditRange<6.1.7.040

openfindmailgatesRange<6.1.7.040

VendorProductVersionCPE
openfindmailaudit*cpe:2.3:a:openfind:mailaudit:*:*:*:*:*:*:*:*
openfindmailgates*cpe:2.3:a:openfind:mailgates:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
openfind	mailaudit	*	cpe:2.3:a:openfind:mailaudit::::::::
openfind	mailgates	*	cpe:2.3:a:openfind:mailgates::::::::

References

www.openfind.com.tw/taiwan/download/Openfind_OF-ISAC-24-007.pdf

www.twcert.org.tw/en/cp-139-7928-04e8a-2.html

www.twcert.org.tw/tw/cp-132-7927-03837-1.html

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

21.1%

JSON

Related for NVD:CVE-2024-6739

cvelist1 vulnrichment1 cve1