Skip to main content

Mail2000 CVE-2024-6741

MEDIUM
Protection Mechanism Failure (CWE-693)
2024-07-15 twcert@cert.org.tw
Authentication Bypass Mail2000
5.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Jul 15, 2024 - 09:15 nvd
MEDIUM 5.3

DescriptionNVD

Openfind's Mail2000 has a vulnerability that allows the HttpOnly flag to be bypassed. Unauthenticated remote attackers can exploit this vulnerability using specific JavaScript code to obtain the session cookie with the HttpOnly flag enabled.

AnalysisAI

Openfind's Mail2000 has a vulnerability that allows the HttpOnly flag to be bypassed. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-693. Openfind's Mail2000 has a vulnerability that allows the HttpOnly flag to be bypassed. Unauthenticated remote attackers can exploit this vulnerability using specific JavaScript code to obtain the session cookie with the HttpOnly flag enabled. Affected products include: Openfind Mail2000.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Mail2000

View all
CVE-2024-6740 MEDIUM POC
6.1 Jul 15

Openfind's Mail2000 does not properly validate email atachments, allowing unauthenticated remote attackers to inject Jav
CVE-2019-9763 MEDIUM POC
6.1 Jun 19

An issue was discovered in Openfind Mail2000 6.0 and 7.0 Webmail. Rated medium severity (CVSS 6.1), this vulnerability i
CVE-2024-5400 HIGH
8.8 May 27

Openfind Mail2000 does not properly filter parameters of specific CGI. Rated high severity (CVSS 8.8), this vulnerabilit
CVE-2024-5399 HIGH
7.2 May 27

Openfind Mail2000 does not properly filter parameters of specific API. Rated high severity (CVSS 7.2), this vulnerabilit
CVE-2020-12776 HIGH
7.2 Sep 01

Openfind Mail2000 contains Broken Access Control vulnerability, which can be used to execute unauthorized commands after
CVE-2023-28705 MEDIUM
6.1 Jun 02

Openfind Mail2000 has insufficient filtering special characters of email content of its content filtering function. Rate
CVE-2019-15073 MEDIUM
6.1 Nov 20

An Open Redirect vulnerability for all browsers in MAIL2000 through version 6.0 and 7.0, which will redirect to a malici
CVE-2019-15072 MEDIUM
6.1 Nov 20

The login feature in "/cgi-bin/portal" in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerab
CVE-2019-15071 MEDIUM
6.1 Nov 20

The "/cgi-bin/go" page in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing

CVE-2023-22902 MEDIUM
5.4 Mar 27

Openfind Mail2000 file uploading function has insufficient filtering for user input. Rated medium severity (CVSS 5.4), t

Same weakness CWE-693 – Protection Mechanism Failure

View all
CVE-2013-2465 CRITICAL POC
9.8
CVE-2013-0431 MEDIUM POC
5.3
CVE-2025-40536 HIGH POC
8.1
CVE-2026-21513 HIGH
8.8
CVE-2026-21510 HIGH POC
8.8
CVE-2026-32202 MEDIUM POC
4.3
CVE-2017-10952 HIGH POC
8.8
CVE-2022-32845 CRITICAL POC
10.0

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2024-6741 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy