Read the docs

Openfind

Records18All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9

Exploited now

Openfind records in CISA KEV

No Openfind vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Mail2000 11 records MEDIUM Mailaudit 3 records MEDIUM Mailgates 3 records MEDIUM

Records

11 records in Mail2000 · all components

TI-2024-05016 CVE-2024-5400

Openfind Mail2000 - OS Command Injection

Priority MEDIUM 41

Openfind Mail2000 does not properly filter parameters of specific CGI.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00578 Published 2024-05-27 Fixed in Patch 34 CWE-78
TI-2024-06248 CVE-2024-6741 · GHSA-v3v6-h9vm-h39c

Openfind Mail2000 - HttpOnly flag bypass

Priority LOW 33

Openfind's Mail2000 has a vulnerability that allows the HttpOnly flag to be bypassed.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.00644 Published 2024-07-15 Fixed in Patch 131, Patch 044 CWE-693
TI-2020-10161 CVE-2020-12776 · GHSA-chfx-f86m-4vj9

Openfind Mail2000 - Broken Access Control

Priority LOW 33

Openfind Mail2000 contains Broken Access Control vulnerability, which can be used to execute unauthorized commands after attackers obtain the administrator access token or cookie.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00833 Published 2020-09-01 No fix listed
TI-2024-05015 CVE-2024-5399

Openfind Mail2000 - OS Command Injection

Priority LOW 32

Openfind Mail2000 does not properly filter parameters of specific API.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00562 Published 2024-05-27 Fixed in Patch 124, Patch 31 CWE-78
TI-2019-11251 CVE-2019-15071 · GHSA-5pcw-pjx7-5hgw

Openfind MAIL2000 Webmail Pre-Auth Cross-Site Scripting

Priority LOW 31

The "/cgi-bin/go" page in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via ACTION parameter without authentication.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01628 Published 2019-11-20 Fixed in Before 20190919, SP4 Patch 076 CWE-79
TI-2019-11252 CVE-2019-15072 · GHSA-pm96-chg7-mq3g

Openfind MAIL2000 Webmail Post-Auth Cross-Site Scripting

Priority LOW 30

The login feature in "/cgi-bin/portal" in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via any parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01516 Published 2019-11-20 Fixed in Before 20190919, SP4 Patch 076 CWE-79
TI-2019-11253 CVE-2019-15073 · GHSA-xf64-8wfw-hq58

Openfind MAIL2000 Webmail Pre-Auth Open Redirect

Priority LOW 29

An Open Redirect vulnerability for all browsers in MAIL2000 through version 6.0 and 7.0, which will redirect to a malicious site without authentication.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01126 Published 2019-11-20 Fixed in Before 20190919, SP4 Patch 076 CWE-601
TI-2024-06247 CVE-2024-6740 · GHSA-qxgh-7pwc-j54v

Openfind Mail2000 - Stored XSS

Priority LOW 28

Openfind's Mail2000 does not properly validate email atachments, allowing unauthenticated remote attackers to inject JavaScript code within the attachment and perform Stored Cross-site scripting attacks.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00502 Published 2024-07-15 Fixed in Patch 131, Patch 044 CWE-79
TI-2023-13222 CVE-2023-28705 · GHSA-j58m-53vx-hhw8

Openfind Mail2000 - XSS (Reflected Cross-site scripting)

Priority LOW 28

Openfind Mail2000 has insufficient filtering special characters of email content of its content filtering function.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00429 Published 2023-06-02 No fix listed CWE-79
TI-2023-09044 CVE-2023-22902 · GHSA-j85v-hrqj-5vp6

Openfind Mail2000 - XSS

Priority LOW 25

Openfind Mail2000 file uploading function has insufficient filtering for user input.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00429 Published 2023-03-27 No fix listed CWE-79
Open these records in search →