topic How to mitigate the below Vulnerability in General Topics

How to mitigate the below Vulnerability

Hardik_Patil_66 — Thu, 02 Mar 2023 09:46:13 GMT

Dear Team,

Missing useful HTTP headers :- Cache-control is an HTTP header used to specify browser caching policies in both client requests and server responses. Policies include how a resource is cached, where it’s cached and its maximum age
before expiring (i.e., time to live).

Using known vulnerable components :- Application is using vulnerable JavaScript libraries. One or more vulnerabilities were reported for this version of the library.

Please help us with the solution to mitigate the same.

Re: How to mitigate the below Vulnerability

Sorin_Gogean — Thu, 02 Mar 2023 10:26:34 GMT

Hello,

Is the error/vulnerability clear for you "Missing useful HTTP headers :- Cache-control is an HTTP header used to specify browser caching policies in both client requests and server responses." ?
On the WebServer you're addressing, seems that you don't have configured "Cache-control" headers.

(go over this and maybe you'll get them clarified)

Can you get us a screenshot of the Log where you see this...

Thank you,

Re: How to mitigate the below Vulnerability

PhoneBoy — Thu, 02 Mar 2023 20:08:27 GMT

Please provide more details about the environment and precisely what Check Point products involved (including version/JHF levels) and how.

Re: How to mitigate the below Vulnerability

Hardik_Patil_66 — Thu, 09 Mar 2023 07:33:37 GMT

We are having cluster setup on version R81.10 with jumbo hotfix take 79.

Re: How to mitigate the below Vulnerability

PhoneBoy — Thu, 09 Mar 2023 18:27:50 GMT

Still need more information:

Who or what exactly is reporting this vulnerability?
What precisely is being scanned? Is it the gateway itself, a device that it's protecting, or something else? What precise tCP ports are being scanned to make this "vulnerable" determination?
Please provide an external reference to said vulnerability (e.g. a CVE # or similar) so we can understand the exact nature of it.

If you don't want to post this information publicly, I suggest opening a TAC case.