CVE-2024-6741

MEDIUM 5.3CVE-2024-6741 · Published 15/07/2024 · updated 17/06/2026

In short

CVE-2024-6741 is a MEDIUM (CVSS 5.3) vulnerability affecting mail2000 (openfind).
Chance of exploitation in the next 30 days (EPSS): 0.64%, higher than 50.9% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
mail2000 openfind	`= 7.0= 8.0`	No fix yet

Description

Openfind's Mail2000 has a vulnerability that allows the HttpOnly flag to be bypassed. Unauthenticated remote attackers can exploit this vulnerability using specific JavaScript code to obtain the session cookie with the HttpOnly flag enabled.

References

openfind.com.tw/taiwan/download/Openfind_OF-ISAC-24-007.pdf · Exploit
twcert.org.tw/en/cp-139-7941-b66e7-2.html · Third Party Advisory
twcert.org.tw/tw/cp-132-7940-0177a-1.html · Third Party Advisory

More vulnerabilities in mail2000

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

mail2000

openfind

= 7.0= 8.0

No fix yet

More vulnerabilities in mail2000

See all →