Session Hijacking Vulnerability in McAfee IntruShield Network Security Manager

CVE-2009-3566

Summary

The McAfee IntruShield Network Security Manager (NSM) prior to version 5.1.11.8.1 is susceptible to session hijacking due to a lack of the HTTPOnly flag in the Set-Cookie header for session identifiers. This oversight permits attackers to exploit cross-site scripting (XSS) vulnerabilities, potentially allowing them to steal session cookies and gain unauthorized access to users' active sessions. This vulnerability underscores the critical need for secure cookie attributes to protect user sessions from unauthorized exploitation.

References