Skip to main content

Sensitive Cookie Without 'HttpOnly' Flag

CVE-2024-6739

Medium
5.3/10

Summary

The session cookie in MailGates and MailAudit from Openfind does not have the HttpOnly flag enabled, allowing remote attackers to potentially steal the session cookie via XSS.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • LOW
  • NONE

CWE-1004 - Sensitive Cookie Without 'HttpOnly' Flag

The software uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.

References

Advisory Timeline

  • Published