The session cookie in MailGates and MailAudit from Openfind does not have the HttpOnly flag enabled, allowing remote attackers to potentially steal the session cookie via XSS.Referenceshttps://www.twcert.org.tw/tw/cp-132-7927-03837-1.htmlhttps://www.twcert.org.tw/en/cp-139-7928-04e8a-2.htmlhttps://www.openfind.com.tw/taiwan/download/Openfind_OF-ISAC-24-007.pdf
