CVE-2014-8525: McAfee Network Data Loss Prevention (NDLP) before 9.3 does not include the HTTPOnly flag in a Set-Cookie he...

Security readout for executives and security teams

McAfee Network Data Loss Prevention before version 9.3 set a session cookie without the HttpOnly protection. If an attacker can get script running in a user's browser, the session cookie may be easier to steal, potentially exposing sensitive session information. Exposure is likely limited to organizations running McAfee Network Data Loss Prevention before 9.3. Risk is higher where the NDLP web interface is reachable by untrusted users or where browser-side script injection is otherwise possible. Treat this as a moderate-priority legacy product hardening issue. It can increase the impact of browser-side compromise against NDLP administrators, but the provided evidence does not show active exploitation or severity scoring. Mitigation focus: Identify any McAfee NDLP deployments and their versions.; If below 9.3, review McAfee SB10053 for vendor-directed remediation.; Restrict access to NDLP web interfaces to trusted networks and administrators..

Prepared

Jun 14, 2026, 06:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.