Unrated severityNVD Advisory· Published Nov 13, 2009· Updated Jun 16, 2026
CVE-2009-3566
CVE-2009-3566
Description
McAfee IntruShield Network Security Manager (NSM) before 5.1.11.8.1 does not include the HTTPOnly flag in the Set-Cookie header for the session identifier, which allows remote attackers to hijack a session by leveraging a cross-site scripting (XSS) vulnerability.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4cpe:2.3:a:mcafee:intrushield_network_security_manager:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:mcafee:intrushield_network_security_manager:*:*:*:*:*:*:*:*range: <=5.1.7.74
- cpe:2.3:a:mcafee:intrushield_network_security_manager:5.1.7.7:*:*:*:*:*:*:*
- cpe:2.3:a:mcafee:intrushield_network_security_manager:5.1.7.73:*:*:*:*:*:*:*
- Range: <5.1.11.8.1
Patches
Vulnerability mechanics
References
9- www.securityfocus.com/bid/37004nvdExploit
- secunia.com/advisories/37178nvdVendor Advisory
- www.vupen.com/english/advisories/2009/3226nvdVendor Advisory
- kc.mcafee.com/corporate/indexnvdVendor Advisory
- securitytracker.com/idnvd
- www.osvdb.org/59912nvd
- www.secureworks.com/ctu/advisories/SWRX-2009-002nvd
- www.securityfocus.com/archive/1/507822/100/0/threadednvd
- exchange.xforce.ibmcloud.com/vulnerabilities/54251nvd
News mentions
0No linked articles in our index yet.