CVE-2024-6739
Openfind MailGates and MailAudit - Sensitive Cookie Without 'HttpOnly' Flag
In short
The session cookie used in Openfind MailGates and MailAudit is missing the HttpOnly flag, which means attackers could steal it through cross-site scripting (XSS) attacks and impersonate users.
Technical detail
The HttpOnly flag is not set on session cookies in Openfind MailGates and MailAudit, enabling attackers to extract session tokens via XSS vulnerabilities. An attacker with the ability to inject malicious scripts into the application can access the cookie through JavaScript and hijack authenticated sessions.
Summary generated and translated by AI from the official description.
The session cookie in MailGates and MailAudit from Openfind does not have the HttpOnly flag enabled, allowing remote attackers to potentially steal the session cookie via XSS.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →