Description
The session cookie in MailGates and MailAudit from Openfind does not have the HttpOnly flag enabled, allowing remote attackers to potentially steal the session cookie via XSS.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Openfind | MailGates | all – < V6.0 6.1.7.040 | V6.0 6.1.7.040 |
| Openfind | MailAudit | all – < V6.0 6.1.7.040 | V6.0 6.1.7.040 |
References
- https://www.twcert.org.tw/tw/cp-132-7927-03837-1.html third-party-advisory
- https://www.twcert.org.tw/en/cp-139-7928-04e8a-2.html third-party-advisory
- https://www.openfind.com.tw/taiwan/download/Openfind_OF-ISAC-24-007.pdf vendor-advisory