Description
Openfind's Mail2000 has a vulnerability that allows the HttpOnly flag to be bypassed. Unauthenticated remote attackers can exploit this vulnerability using specific JavaScript code to obtain the session cookie with the HttpOnly flag enabled.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Openfind Mail2000 V7.0
Default version status: unaffected
all to < Patch 131affected
Openfind Mail2000 V8.0
Default version status: unaffected
all to < Patch 044affected