CVE Daily

CVE-2014-8525

McAfee Network Data Loss Prevention (NDLP) before 9.3 does not include the HTTPO...

Medium CVSS 5.0

Overview

McAfee Network Data Loss Prevention (NDLP) before 9.3 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

CWE: CWE-200 Published: 2014-10-29T14:55:04.643
Risk analysis

This vulnerability is rated 🟡 MEDIUM.

  • CVSS: 5.0 (MEDIUM)
  • Detected tags: none (tag impact: LOW)

Recommended actions:

  • Prioritize remediation based on business criticality and exposure.
  • Limit exposure and increase monitoring until fixed.

Recommended tools

Tags