CVE-2024-6741: Openfind Mail2000 - HttpOnly flag bypass

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-07-15 · updated 2026-06-17
Weakness: CWE-693

Description

Openfind's Mail2000 has a vulnerability that allows the HttpOnly flag to be bypassed. Unauthenticated remote attackers can exploit this vulnerability using specific JavaScript code to obtain the session cookie with the HttpOnly flag enabled.

Affected products

Openfind Mail2000 V8.0: 7.0, 8.0

References

https://www.openfind.com.tw/taiwan/download/Openfind_OF-ISAC-24-007.pdf
https://www.twcert.org.tw/en/cp-139-7941-b66e7-2.html
https://www.twcert.org.tw/tw/cp-132-7940-0177a-1.html
https://www.openfind.com.tw/taiwan/download/Openfind_OF-ISAC-24-007.pdf
https://www.twcert.org.tw/en/cp-139-7941-b66e7-2.html
https://www.twcert.org.tw/tw/cp-132-7940-0177a-1.html

Get alerted when CVE-2024-6741 or the next vulnerability affects your stack