Mitigating Missing SameSite Cookie Flag Vulnerability (CWE-1275) in CA Service Desk Manager.

Products

• CA Service Desk Manager

Issue/Introduction

During a security assessment or automated vulnerability scan, CA Service Desk Manager (CA SDM) may be flagged for missing the SameSite attribute on sensitive session cookies.
Cookies defined without the SameSite attribute (or without enforced secure connection flags) can be transmitted during cross-origin requests. This increases the risk of Cross-Site Request Forgery (CSRF) attacks and unauthorized cross-site cookie transmission.

Environment

Release: CA Service desk Manager 17.4.4.

Resolution

To secure application session cookies and satisfy security compliance requirements, enable the mandatory security flags in CA SDM Options Manager.
Step-by-Step Configuration
Step1 : Log into CA SDM as an Administrator.
            Navigate to Options Manager:
            Go to Administration tab → Options Manager → Security.
            Install the Security Options:
            Locate force_browser_to_send_cookie_only_in_ssl_connection:
            Click Install.
           (Ensures cookies are marked as Secure and transmitted strictly over encrypted HTTPS connections).
           Locate use_encrypted_sid_and_cookie:
           Click Install.
           (Enforces session ID encryption and hardens cookie handling against cross-site tampering).
Step 2: Recycle CA Service Desk Manager Services: