CVE-2024-6741

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Openfind's Mail2000 has a vulnerability that allows the HttpOnly flag to be bypassed. Unauthenticated remote attackers can exploit this vulnerability using specific JavaScript code to obtain the session cookie with the HttpOnly flag enabled.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-693

Affected software

Vendor	Product	Versions
Openfind	Mail2000 V7.0	>= all, < Patch 131
Openfind	Mail2000 V8.0	>= all, < Patch 044
openfind	mail2000	< patch_131
openfind	mail2000	< patch_044

References

https://www.openfind.com.tw/taiwan/download/Openfind_OF-ISAC-24-007.pdfExploit
https://www.twcert.org.tw/en/cp-139-7941-b66e7-2.htmlThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-7940-0177a-1.htmlThird Party Advisory
https://www.openfind.com.tw/taiwan/download/Openfind_OF-ISAC-24-007.pdfExploit
https://www.twcert.org.tw/en/cp-139-7941-b66e7-2.htmlThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-7940-0177a-1.htmlThird Party Advisory

Timeline

Published: Jul 15, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-67425.4AguardNet Technology's Space Management System does not properly filter user input, allowing remote attackers with regular privileges to inj CVE-2024-67439.8AguardNet's Space Management System does not properly validate user input, allowing unauthenticated remote attackers to inject arbitrary SQL CVE-2024-67449.8The SMTP Listener of Secure Email Gateway from Cellopoint does not properly validate user input, leading to a Buffer Overflow vulnerability.CVE-2024-67459.8A vulnerability classified as critical has been found in code-projects Simple Ticket Booking 1.0. Affected is an unknown function of the fil CVE-2024-67468.8A vulnerability classified as problematic was found in NaiboWang EasySpider 0.6.2 on Windows. Affected by this vulnerability is an unknown f CVE-2024-67477.5Information leakage in mknotifyd in Checkmk before 2.3.0p18, 2.2.0p36, 2.1.0p49 and in 2.0.0p39 (EOL) allows attacker to get potentially sen CVE-2024-67488.3Zohocorp ManageEngine OpManager, OpManager Plus, OpManager MSP and RMM versions 128317 and below are vulnerable to authenticated SQL injecti CVE-2024-67496.3Seth Fogie, member of the AXIS Camera Station Pro Bug Bounty Program, has found that the Incident report feature may expose sensitive creden CVE-2024-67507.5The Social Auto Poster plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability CVE-2024-67516.5The Social Auto Poster plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.3.14. This is du CVE-2024-67525.4The Social Auto Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wp_name’ parameter in the 'wpw_auto_poster CVE-2024-67536.1The Social Auto Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mapTypes’ parameter in the 'wpw_auto_poste