CSCvt31126 - ENH allow http-only-cookie for web connection

[lnguyen@meriwest.com]

anybody else have this issue or know the patch from Cisco? i have not see anything from Cisco for this bug.

thanks

[ttran32]

Internal vulnerability scanner picked up this vulnerability and have been looking for a resolution as well. 

[Aomar bahloul]

This issue has been carried over from the ASAs, Cisco Bug: CSCvt31126 - ENH: allow http-only-cookie for web connection

On the ASA they had a fix for it but apparently no workaround for the FTDs. Also, the severity was lowered from 2 Severe to 6 Enhancement go figure! I opened a TAC case for it even thought I doubt they will have a fix. 

[Vicente Miño]

Hey Aomar, Did you receive any response from Cisco? I am having a similar problem like this case.

[Aomar bahloul]

Yes, with the FTDs you need to use FlexConfig, first you need to create a Flex Object than attach it to the device FlexConfig Policy here is how the object looks like: