CVE-2024-6741mediumCWE-693

CVE-2024-6741: medium-severity vulnerability in Openfind Mail2000 V7.0

Openfind Mail2000 - HttpOnly flag bypass

Published · Updated

Follow this CVE+ Monitor Mail2000

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.8epss 0.6%
Openfind's Mail2000 has a vulnerability that allows the HttpOnly flag to be bypassed. Unauthenticated remote attackers can exploit this vulnerability using specific JavaScript code to obtain the session cookie with the HttpOnly flag enabled.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Affected products
Openfind · Mail2000 V7.0Openfind · Mail2000 V8.0
Related CVEs — Openfind Mail2000 V7.0

In the same product, most dangerous first.

CVE-2024-5400HIGHOpenfind Mail2000 - OS Command InjectionEPSS 0.6%CVE-2024-5399HIGHOpenfind Mail2000 - OS Command InjectionEPSS 0.6%CVE-2024-6740MEDIUMOpenfind Mail2000 - Stored XSSEPSS 0.5%