Session Management Flaw in McAfee Email and Web Security

CVE-2012-4581

Summary

A vulnerability in McAfee Email and Web Security and McAfee Email Gateway allows attackers to exploit improper session token handling. When the Management Console or Dashboard is closed, the server-side session token remains active, potentially leading to session hijacking. This occurs when an attacker captures a valid session cookie and manipulates it to gain unauthorized access. To mitigate this risk, it is crucial to apply the latest security patches and follow best practices for session management.

References