http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.
7.1.1+dfsg-17.2.0+dfsg-17.3.0+dfsg-17.3.0+dfsg-1ubuntu27.3.0+dfsg-1ubuntu37.3.1+dfsg-47.3.1+dfsg-4ubuntu0.13.10.12-1~22.04.163.12.3-1ubuntu0.157.3.19+dfsg-17.3.19+dfsg-27.3.20+dfsg-17.3.20+dfsg-33.13.3-13.13.3-23.13.3-43.13.4-13.13.5-13.13.5-23.13.6-13.13.7-13.13.7-1ubuntu0.13.13.7-1ubuntu0.2+2 more3.14.0-13.14.0-1ubuntu0.13.14.0-1ubuntu0.23.14.0-1ubuntu0.33.14.0~a7-0ubuntu13.14.0~b1-13.14.0~b3-13.14.0~rc1-13.14.0~rc2-13.14.0~rc3-13.14.4-1ubuntu0.12.7.6-8ubuntu0.6+esm303.4.3-1ubuntu1~14.04.7+esm213.5.2-2ubuntu0~16.04.4~14.04.1+esm11Exploitability
AV:NAC:LAT:PPR:HUI:NVulnerable System
VC:LVI:LVA:NSubsequent System
SC:NSI:NSA:NCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N