exploitDog

CVE-2009-3566

Опубликовано: 13 нояб. 2009

Источник: nvd

CVSS2: 4.3

EPSS Низкий

Описание

McAfee IntruShield Network Security Manager (NSM) before 5.1.11.8.1 does not include the HTTPOnly flag in the Set-Cookie header for the session identifier, which allows remote attackers to hijack a session by leveraging a cross-site scripting (XSS) vulnerability.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:mcafee:intrushield_network_security_manager:*:*:*:*:*:*:*:*

Версия до 5.1.7.74 (включая)

cpe:2.3:a:mcafee:intrushield_network_security_manager:5.1.7.7:*:*:*:*:*:*:*

cpe:2.3:a:mcafee:intrushield_network_security_manager:5.1.7.73:*:*:*:*:*:*:*

EPSS

Процентиль: 90%

0.05123

Низкий

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-qxpm-m6jm-3crx

github

почти 4 года назад

McAfee IntruShield Network Security Manager (NSM) before 5.1.11.8.1 does not include the HTTPOnly flag in the Set-Cookie header for the session identifier, which allows remote attackers to hijack a session by leveraging a cross-site scripting (XSS) vulnerability.

EPSS

Процентиль: 90%

0.05123

Низкий

4.3 Medium

CVSS2

Дефекты

CWE-79