When the cookie is created by the web app, there are optional flags which can be set to restrict how the cookie is used. With no flags set, the cookies can be read over an insecure connection or may be used in unexpected and unplanned ways.
To remediation your finding, you will need to ensure that the correct flags are set when the cookie is created. In a normal web app you would do this by modifying the source code at the point where the cookie is created or if you are using a library function to create the cookie, it may be an optional parameter.
For some general information, consult OWASP SecureFlag page.
Since your noted Exchange 2010, I am assuming this is on the web based email component for users to read their email in the browser as opposed to Outlook, etc. This should be an option in your
web.config which may be found under a path like
Program Files\Microsoft\Exchange Server\V14\ClientAccess\Owa. After your browsing, I see this was already answered on ServerFault
<httpCookies httpOnlyCookies="true" requireSSL="true"/>