topic "Session cookie has no SameSite attribute: Session" vulnerability found on Management server R80.40 in General Topics

"Session cookie has no SameSite attribute: Session" vulnerability found on Management server R80.40

LeeBingKang — Mon, 07 Aug 2023 08:52:27 GMT

Recently, my client ran a VA scan on their R80.40 managment server and found out that is a vulnerability called "Session cookie has no SameSite attribute: Session". I tried to find from internet resources and CheckPoint SK, but no relevant resolution for this issue.

Hence, appreciate if you all can share some suggestions on solving this matter.

Thank you.

Re: "Session cookie has no SameSite attribute: Session" vulnerability found on Management

Chris_Atkinson — Mon, 07 Aug 2023 11:57:50 GMT

Is the machine running a recent jumbo?

Regardless I would suggest engaging TAC with relevant details.

Re: "Session cookie has no SameSite attribute: Session" vulnerability found on Management

LeeBingKang — Tue, 08 Aug 2023 09:16:42 GMT

Hi @Chris_Atkinson , the machine is not with latest Jumbo Hotfix, but i will install the latest recommended hotfix as it resolved the Slowloris DoS vulnerability.

Re: "Session cookie has no SameSite attribute: Session" vulnerability found on Management

Chris_Atkinson — Tue, 08 Aug 2023 10:47:19 GMT

T180 and higher will help with Slowloris