03-20-2024 07:20 AM
Hi @MingIkehara ,
As far as I know this is a false positive alert.
How to check the presence of Response Security Headers in PAN-OS
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HC9uCAG&lang=en_US%E2%80%A...
Connection: keep-alive
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; img-src * data:; style-src 'self' 'unsafe-inline';
Please NOTE, because we use inline scripts for multiple purpose/locations, there is no easy way to remove the unsafe-inline tag from the CSP header.
There is a feature request planned for PAN-OS which has no ETA as of yet as it requires Source code change.
This vulnerability is not considered as a threat, and we have Feature Request ID: 19173.
By providing this Feature ID you can add your vote to it and check with your Account team when it is implemented.
Kind regards,
-Kim.
