The vulnerability description explicitly states that the CookieInterceptor component failed to use the parameter-name whitelist. Attackers exploited this by sending malicious cookies containing OGNL expressions, which were processed without validation(). While the provided commit diff shows fixes in other interceptors (e.g., ConversionErrorInterceptor) to escape OGNL expressions, the root cause lies in the CookieInterceptor's lack of whitelist enforcement. The absence of whitelist checks in cookie parameter handling directly aligns with the CVE's technical details and exploit examples involving HTTP Cookie headers.