CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Insertion of Sensitive Information Into Sent Data vulnerability in Johan Jonk Stenström Cookies and Content Security Policy cookies-and-content-security-policy allows Retrieve Embedded Sensitive Data.This issue affects Cookies and Content Security Policy: from n/a through <= 2.34.
Explanation of Vulnerability in Simple Terms
Cookies and Content Security Policy versions 2.34 and earlier expose sensitive information through improper handling of cookie data. An attacker on the network can read limited confidential information without authentication or user interaction. The vulnerability affects how the product manages cookies in relation to CSP headers, potentially leaking data to unauthorized parties.
What an attacker can do
Read sensitive cookie or CSP-related data transmitted over the network without authentication.
Potential impact on your site
Visitor or user data in cookies may be exposed to network-level attackers; CSP bypass or cookie leakage possible.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
