CVE-2024-6741 Openfind Mail2000 - HttpOnly flag bypass

What is CVE-2024-6741?

CVE-2024-6741 is a medium-severity vulnerability in Openfind Mail2000 V7.0, published on 15 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Openfind's Mail2000 has a vulnerability that allows the HttpOnly flag to be bypassed. Unauthenticated remote attackers can exploit this vulnerability using specific JavaScript code to obtain the session cookie with the HttpOnly flag enabled.

Weakness: CWE-693

Which versions are affected by CVE-2024-6741?

It affects 1 product.

Products include Openfind Mail2000.

How do I fix CVE-2024-6741?

No fix has been published for CVE-2024-6741 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-6741 being exploited?

There is no known exploitation of CVE-2024-6741 in the wild and no public exploit code.

Other vulnerabilities in Openfind Mail2000 V7.0

• CVE-2024-5400 Openfind Mail2000 - OS Command Injection High 8.8
• CVE-2024-5399 Openfind Mail2000 - OS Command Injection High 7.2
• CVE-2020-12776 Openfind Mail2000 - Broken Access Control Medium 6.6
• CVE-2024-6740 Openfind Mail2000 - Stored XSS Medium 6.1
• CVE-2019-15071 Openfind MAIL2000 Webmail Pre-Auth Cross-Site Scripting Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-v3v6-h9vm-h39c.