McAfee Email and Web Security Appliance v5.6 – Session hijacking (and bypassing client-side session timeouts)

McAfee Email and Web Security Appliance v5.6 (v5.6 1741.115) contains a session hijacking vulnerability that allows an attacker who obtains a session token (for example via XSS) to bypass client-side timeouts and log in as an administrator; the report includes a proof-of-concept using intercepting proxies and documents discovery and a vendor fix released in March 2012.