Threats tagged 'ghsa-g3vg-xwg9-qrvh'

CakePHP versions through 5.4.3 have a vulnerability in the Http Client CookieCollection component due to improper cookie domain validation. This flaw allows malicious servers to exploit unanchored suffix matching to receive and plant cookies improperly. Attackers controlling domains with suffixes matching the victim's domain or sending Set-Cookie headers with unrelated domain values can steal or inject cookies into client cookie jars.