【資安漏洞預警】Openfind 使用第三方工具存在安全漏洞，可能引發XSS跨腳本攻擊

【行政公告】

公告單位	圖資處數位服務組
訊息類別	行政公告行政公告	公告對象	全體
公告主題	【資安漏洞預警】Openfind 使用第三方工具存在安全漏洞，可能引發XSS跨腳本攻擊 [Security Vulnerability Alert] Openfind uses a third-party tool with a security vulnerability that could lead to XSS cross-scripting attacks
公告內容	轉發台灣電腦網路危機處理暨協調中心 TWCERTCC-200-202508-00000018 [內容說明] 近日Openfind 電子郵件威脅實驗室於分析存取紀錄時，發現MailGates / MailAudit 系統中使用的第三方工具存在安全漏洞，目前已發現有攻擊者以 XSS 跨站腳本攻擊成功，可能導致用戶資料外洩及檔案系統未授權存取。 Openfind 已更新受影響的第三方模組版本，並釋出安全性修補程式(Security Patch)，建議使用者儘速完成更新。 [影響平台] MailGates 5.0/6.0、MailAudit 5.0/6.0 [建議措施] MailGates / MailAudit 標準版至 [線上更新] 頁面更新： v6.0 版本請依序更新 Patch 至 6.1.9.050 v5.0 版本請依序更新 Patch 至 5.2.10.097 [參考資料] 1. Openfind_OF-ISAC-25-002 https://www.openfind.com.tw/taiwan/download/Openfind_OF-ISAC-25-002.pdf Forwarded from Taiwan Computer Network Crisis Response and Coordination Center (TWCERTCC-200-202508-00000018) [Content Description] Recently, the Openfind Email Threat Lab discovered a security vulnerability in a third-party tool used in the MailGates/MailAudit systems while analyzing access logs. Attackers have been found to have successfully exploited a cross-site scripting (XSS) attack, potentially leading to user data leakage and unauthorized access to file systems. Openfind has updated the affected third-party module version and released a security patch. Users are advised to update as soon as possible. [Affected Platforms] MailGates 5.0/6.0, MailAudit 5.0/6.0 [Recommended Action] MailGates / MailAudit Standard Edition: Update to the [Online Update] page: For version 6.0, please update the patch to 6.1.9.050. For version 5.0, please update the patch to 5.2.10.097. [References] 1. Openfind_OF-ISAC-25-002 https://www.openfind.com.tw/taiwan/download/Openfind_OF-ISAC-25-002.pdf
相關訊息	參考資料：Openfind_OF-ISAC-25-002
公告時間	2025/8/28 至 2026/2/28	點閱次數	31