← Database

CVE-2009-3566

MEDIUM CVSS: 4.3 Published: 2009-11-13 Modified: 2026-06-16

Description

McAfee IntruShield Network Security Manager (NSM) before 5.1.11.8.1 does not include the HTTPOnly flag in the Set-Cookie header for the session identifier, which allows remote attackers to hijack a session by leveraging a cross-site scripting (XSS) vulnerability.

Affected Platforms

Mcafee Intrushield Network Security Manager

Weakness Type

CWE-79

References