CVE-2024-6739
15.07.2024, 04:15
The session cookie in MailGates and MailAudit from Openfind does not have the HttpOnly flag enabled, allowing remote attackers to potentially steal the session cookie via XSS.Enginsight
| Vendor | Product | Version |
|---|---|---|
| openfind | mailaudit | 𝑥 < 6.1.7.040 |
| openfind | mailgates | 𝑥 < 6.1.7.040 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-1004 - Sensitive Cookie Without 'HttpOnly' FlagThe software uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.
- CWE-732 - Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
References