CVE-2024-6739CWE-1004

Openfind MailGates and MailAudit - Sensitive Cookie Without 'HttpOnly' Flag

Medium · published July 15, 2024

CVSS v3.1
5.3
EPSS
0%
Percentile
37.8
In the wild
Unconfirmed
What it is

The session cookie in MailGates and MailAudit from Openfind does not have the HttpOnly flag enabled, allowing remote attackers to potentially steal the session cookie via XSS.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00447 · 37.8th percentile
Weakness
CWE-1004 · Sensitive Cookie Without 'HttpOnly' Flag
Published
2024-07-15T03:15Z
EPSS history
Timeline
  • 15 JUL 03:15Z
    Openfind MailGates and MailAudit - Sensitive Cookie Without 'HttpOnly' Flag
    cvelistv5