Rule Definition
If read access is not properly restricted, then attackers can steal the sensitive information. If write access is not properly restricted, then attackers can modify and possibly delete the data, causing incorrect results and possibly a denial of service. The cookies with an overly broad domain can be accessed by all web applications deployed on this domain and its sub-domains. A cookie with sensitive data, but with too broad a domain, could hence be read and tampered with by a less secure and untrusted application.

Remediation
Do not provide a domain with wildcard access

Violation Code Sample

// .example.com is not recommended 
document.cookie = "name=test; domain=.example.com; secure";

Fixed Code Sample

// explicit secure.example.com domain is recommended 
document.cookie = "name=test; domain=secure.example.com; secure";

https://cwe.mitre.org/data/definitions/287.html https://www.owasp.org/index.php/Top_10_2013-A6-Sensitive_Data_Exposure https://www.owasp.org/index.php/Top_10-2017_A3-Sensitive_Data_Exposure