Threats tagged 'ghsa-gj8w-9f6j-v33q'

cordova-plugin-advanced-http versions 1.5.0 through 3.3.1 have an information disclosure vulnerability that leaks cookies to third-party hosts. This occurs because the JavaScript layer passes jar-built Cookie headers as ordinary request headers. When requests are redirected to another host, the native iOS and Android stacks forward the Cookie header, potentially allowing attackers to hijack user sessions.