Cookies in PAM not configured to be HttpOnly

Products

• CA Privileged Access Manager (PAM)
• CA Privileged Access Manager - Server Control (PAMSC)
• CA Privileged Identity Management Endpoint (PIM)
• CA Threat Analytics for PAM

Issue/Introduction

Security scanners may report when launched against a PAM appliance, that some cookies are not HttpOnly

While this may be indicative of a security weakness, in the case of PAM even though some of them are set so, this does not pose a security risk

Environment

CA Privileged Access Manager (PAM)

Resolution

Hereby a list of cookies which are not set for HttpOnly and the reason why they do not pose a security risk:

Cookie Name	Explanation
Xsuite_IdP_Proxy_Sticky	This cookie is not used for session maintenance or authentication.
jsid	This cookie is a copy of PHPSESSID and it is loaded to link session id, so it can't be httponly
fromindexphp	This is not used for session maintenance.
JSESSIONID	This cookie is not used for session maintenance.

As noticed none of the cookies described may be used to steal a session or to perform any malicious activity so they do not require HttpOnly.