Openfind MAIL2000 Webmail Pre-Auth Open Redirect
Priority LOW 29CWE-601Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-601.
Summary
An Open Redirect vulnerability for all browsers in MAIL2000 through version 6.0 and 7.0, which will redirect to a malicious site without authentication. This vulnerability affects many mail system of governments, organizations, companies and universities.
Why it matters now
EPSS 0.01126 66th percentileScored 2026-11-07
Fix Fixed MAIL2000 (Openfind): Before 20190919, SP4 Patch 076
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Openfind | MAIL2000 | 6.0 to before Before 20190919; 7.0 to before SP4 Patch 076 | Before 20190919, SP4 Patch 076 | Patch available | CNA |
- MAIL2000 VendorOpenfind Affected 6.0 to before Before 20190919; 7.0 to before SP4 Patch 076 Fixed in Before 20190919, SP4 Patch 076 Patch available CNA
Remediation
- Fix · CNA MAIL2000 (Openfind) Fixed in Before 20190919, SP4 Patch 076
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Openfind MAIL2000 Before 20190919, SP4 Patch 076
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2019-11251 Openfind MAIL2000 Webmail Pre-Auth Cross-Site ScriptingPriority LOW 31
- TI-2019-11252 Openfind MAIL2000 Webmail Post-Auth Cross-Site ScriptingPriority LOW 30
Timeline
- 2026-10-02 Threatist record created from CVE-2019-15073
- 2026-10-03 Alias added: GHSA-xf64-8wfw-hq58
References
Advisory 6
- https://www.openfind.com.tw/taiwan/resource.html
- https://gist.github.com/chtsecurity/512ebad24dddffb5321cf5f1a336f90f
- https://gist.github.com/tonykuo76/ed1cc21cf755bfb8b67ca24f50bded13
- https://www.chtsecurity.com/download/258686130f7a16063c765f9e79cffd813409f6fe61c2dec05fceca541762d5bd.txt
- https://www.twcert.org.tw/en/cp-128-3087-5cecd-2.html
- https://tvn.twcert.org.tw/taiwanvn/TVN-201909003
More Openfind Mail2000 vulnerabilities
- TI-2024-05016 Openfind Mail2000 - OS Command Injection CVSS 3.1HIGH 8.8
- TI-2024-06248 Openfind Mail2000 - HttpOnly flag bypass CVSS 3.1MEDIUM 5.8
- TI-2020-10161 Openfind Mail2000 - Broken Access Control CVSS 3.1HIGH 7.2
- TI-2024-05015 Openfind Mail2000 - OS Command Injection CVSS 3.1HIGH 7.2
- TI-2019-11251 Openfind MAIL2000 Webmail Pre-Auth Cross-Site Scripting CVSS 3.1MEDIUM 6.1
- TI-2019-11252 Openfind MAIL2000 Webmail Post-Auth Cross-Site Scripting CVSS 3.1MEDIUM 6.1
Sources
- CVE-2019-15073 · CVE Program
- CVE-2019-15073 · NVD
- FIRST EPSS
- GHSA-xf64-8wfw-hq58 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences