DerScanner
Home / Vulnerability Database / Objective-C : Cookie: broad domain
Objective-C

Objective-C : Cookie: broad domain

Classification

OWASP Mobile Top 10 2014
M9-Improper Session Handling
OWASP Mobile Top 10 2016
M4-Insecure AuthenticationM2-Insecure Data Storage
OWASP Top 10 2017
A2-Broken AuthenticationA3-Sensitive Data Exposure
OWASP Top 10 2021
A2-Cryptographic FailuresA4-Insecure DesignA7-Identification and Authentication Failures
PCI DSS 4.0
6.2.4
HIPAA
§164.312 (e)(1)
CWE
CWE-1028

Overview

Cookie domain is set broadly. Broad domain (e.g., .example.com) is insecure, because in this case the vulnerability in one application may endanger other applications in the same domain.

Sensitive Data Exposure vulnerabilities take the third place in the “OWASP Top 10 2017” web-application vulnerabilities ranking.

References

  1. OWASP Top 10 2013-A5-Security Misconfiguration
  2. Origin Cookies: Session Integrity for Web Applications (pdf)
  3. NSHTTPCookieStorage - developer.apple.com
  4. OWASP Mobile Top 10 2016-M4-Insecure Authentication
MEDIUM

DerScanner Severity Score

Do you want to fix Objective-C : Cookie: broad domain in your application?

See also

Objective-C

Objective-C : Internal information leak

Objective-C

Objective-C : Weak hashing algorithm

Objective-C

Objective-C : Unsafe reflection