This vulnerability in the Cookies and Content Security Policy product allows an attacker to insert sensitive information into data sent by the application, which could lead to unauthorized retrieval of embedded sensitive data. It affects all versions up to 2.34. The CVSS vector indicates the attack can be performed remotely without privileges or user interaction, with low complexity, and impacts confidentiality only. No known exploits or patches are currently documented.

The vulnerability impacts confidentiality by allowing sensitive information to be exposed through inserted data in sent communications. There is no impact on integrity or availability. Exploitation could lead to unauthorized disclosure of sensitive data handled by the affected component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for vendor updates and apply any future patches promptly. Until a fix is available, consider restricting exposure of the affected component and reviewing data handling policies to minimize sensitive data leakage.