Issues with security scan of nessus

suchanm

I have tenable nesuss scan on infra and from xormon appliance I am getting info like

The remote web server is not enforcing HSTS, as defined by RFC 6797. HSTS is an optional response header that can be configured on the server to instruct the browser to only communicate via HTTPS. The lack of HSTS allows downgrade attacks, SSL-stripping man-in-the-middle attacks, and weakens cookie-hijacking protections.

Does anybody was able to fix this?

TomasJetelina

Are you referring to Xormon Original or Xormon NG?

Pavel

is that about Xormon Original (lpar2rrd/stor2rrd app front-end) or Xormon Next Generation (NG)?

suchanm

Its for the xormon original deployed as OVA Appliance.

TomasJetelina

What Xormon Original version do you run?

Do you know which request it is? I see strict-transport-security header on responses.