CVE-2014-8525

McAfee Network Data Loss Prevention < 9.3 - Session Cookie Exposure via Missing HTTPOnly Flag

Title source: llm
STIX 2.1

Description

McAfee Network Data Loss Prevention (NDLP) before 9.3 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/70823
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/98431

Scores

EPSS 0.0046
EPSS Percentile 64.0%

Details

CWE
CWE-200
Status published
Products (4)
mcafee/network_data_loss_prevention 8.6
mcafee/network_data_loss_prevention 9.2.0
mcafee/network_data_loss_prevention 9.2.1
mcafee/network_data_loss_prevention < 9.2.2
Published Oct 29, 2014
Tracked Since Feb 18, 2026