Rule Definition
If read access is not properly restricted, then attackers can steal sensitive information. If write access is not properly restricted, then attackers can modify and possibly delete the data, causing incorrect results and possibly a denial of service. Cookies with an overly broad path, such as the root context path ("/"), can be accessed by all web applications on the same domain name. A cookie with sensitive data, but with too broad a path, could hence be read and tampered by a less secure and untrusted application.

Remediation
Do not provide a root path

Violation Code Sample

// root path is not recommended 
document.cookie = "name=test; path=/; secure";

Fixed Code Sample

// specifc path is recommended 
document.cookie = "name=test; path=/admin; secure";

https://cwe.mitre.org/data/definitions/287.html https://www.owasp.org/index.php/Top_10_2013-A6-Sensitive_Data_Exposure https://www.owasp.org/index.php/Top_10-2017_A3-Sensitive_Data_Exposure