CVE-2024-6739: medium-severity vulnerability in Openfind MailGates
Openfind MailGates and MailAudit - Sensitive Cookie Without 'HttpOnly' Flag
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The session cookie used in Openfind MailGates and MailAudit is missing the HttpOnly flag, which means attackers could steal it through cross-site scripting (XSS) attacks and impersonate users.
The HttpOnly flag is not set on session cookies in Openfind MailGates and MailAudit, enabling attackers to extract session tokens via XSS vulnerabilities. An attacker with the ability to inject malicious scripts into the application can access the cookie through JavaScript and hijack authenticated sessions.
In the same product, most dangerous first.