NetSight
IP …
medium4.3Public exploit code

CVE-2009-3566

McAfee IntruShield Network Security Manager (NSM) before 5.1.11.8.1 does not include the HTTPOnly flag in the Set-Cookie header for the session identifier, whi…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

McAfee IntruShield Network Security Manager (NSM) before 5.1.11.8.1 does not include the HTTPOnly flag in the Set-Cookie header for the session identifier, which allows remote attackers to hijack a session by leveraging a cross-site scripting (XSS) vulnerability.

Affected products

VendorProductAffected versions
McafeeIntrushield Network Security Manager
through 5.1.7.74
Versions 5.1.7.7, 5.1.7.73

Weakness classification

CWE-79

References