Description (CNA)
The session cookie in MailGates and MailAudit from Openfind does not have the HttpOnly flag enabled, allowing remote attackers to potentially steal the session cookie via XSS.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Openfind / MailGates | affected all before V6.0 6.1.7.040 |
| Openfind / MailAudit | affected all before V6.0 6.1.7.040 |
CWE
CWE-1004
References
- https://www.twcert.org.tw/tw/cp-132-7927-03837-1.html
- https://www.twcert.org.tw/en/cp-139-7928-04e8a-2.html
- https://www.openfind.com.tw/taiwan/download/Openfind_OF-ISAC-24-007.pdf
ADP enrichment
No English description supplied.
No references supplied.
No English description supplied.