- Security-news - lists.drupal.org

Klaro Cookie & Consent Management - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-080
by security-news＠drupal.org 25 Jun '25

25 Jun '25

View online: https://www.drupal.org/sa-contrib-2025-080 Project: Klaro Cookie & Consent Management [1] Date: 2025-June-25 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site Scripting Affected versions: <3.0.7 CVE IDs: CVE-2025-5682 Description: Klaro Cookie & Consent Management module is used for consent management for cookies and external sources. It makes changes to the markup to enable or disable loading. The module doesn't sufficiently sanitize some HTML attributes allowing persistent Cross-site Scripting (XSS) attacks. This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific attributes. Solution: Install the latest version: * If you use the Klaro Cookie & Consent Management module for Drupal 10.x/11.x, upgrade to Klaro Cookie & Consent Management 3.0.7 [3] Reported By: * Pierre Rudloff (prudloff) [4] provisional member of the Drupal Security Team Fixed By: * Jan Kellermann (jan kellermann) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team * Pierre Rudloff (prudloff) [8] provisional member of the Drupal Security Team [1] https://www.drupal.org/project/klaro [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/3532264 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/jan-kellermann [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/poker10 [8] https://www.drupal.org/u/prudloff

1 0

Open Social - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-079
by security-news＠drupal.org 25 Jun '25

25 Jun '25

View online: https://www.drupal.org/sa-contrib-2025-079 Project: Open Social [1] Date: 2025-June-25 Security risk: *Moderately critical* 13 ∕ 25 AC:None/A:User/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Request Forgery Affected versions: <12.3.14 || >=12.4.0 <12.4.13 CVE IDs: CVE-2025-48921 Description: Open Social is a Drupal distribution for online communities, which ships with a default module that allows users to enroll in events. The module doesn't sufficiently protect certain routes from Cross Site Request Forgery (CSRF) attacks. Users can be tricked into accepting or rejecting these enrollments. This issue only affects sites that have event enrollments enabled for an event. Solution: Install the latest version: * If you use Open Social 12.3.x upgrade to Open Social 12.3.14 [3] * If you use Open Social 12.4.x upgrade to Open Social 12.4.13 [4] Reported By: * Ivo Van Geertruyen (mr.baileys) [5] of the Drupal Security Team Fixed By: * Alexander Varwijk (kingdutch) [6] * Robert Ragas (robertragas) [7] Coordinated By: * Greg Knaddison (greggles) [8] of the Drupal Security Team [1] https://www.drupal.org/project/social [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/social/releases/12.3.14 [4] https://www.drupal.org/project/social/releases/12.4.13 [5] https://www.drupal.org/u/mrbaileys [6] https://www.drupal.org/u/kingdutch [7] https://www.drupal.org/u/robertragas [8] https://www.drupal.org/u/greggles

1 0

GLightbox - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-078
by security-news＠drupal.org 25 Jun '25

25 Jun '25

View online: https://www.drupal.org/sa-contrib-2025-078 Project: GLightbox [1] Date: 2025-June-25 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross-site Scripting Affected versions: <1.0.16 CVE IDs: CVE-2025-48922 Description: GLightbox module is a pure Javascript lightbox for CKEditor. The module doesn't sufficiently filter user-supplied text for the GLightbox Javascript library leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permissions to edit content that is configured to support the Glightbox module. Solution: Install the latest version: * If you use the GLightbox module, upgrade to GLightbox 1.0.16 [3] Reported By: * Pierre Rudloff (prudloff) [4] provisional member of the Drupal Security Team Fixed By: * Ivan Abramenko (levmyshkin) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Pierre Rudloff (prudloff) [7] provisional member of the Drupal Security Team [1] https://www.drupal.org/project/glightbox [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/3529736 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/levmyshkin [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/prudloff

1 0

Toc.js - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-077
by security-news＠drupal.org 25 Jun '25

25 Jun '25

View online: https://www.drupal.org/sa-contrib-2025-077 Project: Toc.js [1] Date: 2025-June-25 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross-site Scripting Affected versions: <3.2.1 CVE IDs: CVE-2025-48923 Description: This module enables you to generate Table of content of your pages given a configuration. The module doesn't sufficiently sanitise data attributes allowing persistent Cross-site Scripting (XSS) attacks. This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes using other modules. Solution: Install the latest version: * If you use the Toc JS module, upgrade to Toc Js 3.2.1 [3] Reported By: * Pierre Rudloff (prudloff) [4] provisional member of the Drupal Security Team Fixed By: * Flocon de toile (flocondetoile) [5] * Frank Mably (mably) [6] * Pierre Rudloff (prudloff) [7] provisional member of the Drupal Security Team Coordinated By: * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team * Pierre Rudloff (prudloff) [10] provisional member of the Drupal Security Team [1] https://www.drupal.org/project/toc_js [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/toc_js/releases/3.2.1 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/flocondetoile [6] https://www.drupal.org/u/mably [7] https://www.drupal.org/u/prudloff [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://www.drupal.org/u/prudloff

1 0

COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-076
by security-news＠drupal.org 28 May '25

28 May '25

View online: https://www.drupal.org/sa-contrib-2025-076 Project: COOKiES Consent Management [1] Date: 2025-May-28 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Scripting Affected versions: <1.2.15 CVE IDs: CVE-2025-48915 Description: The COOKIES module protects users from executing JavaScript code provided by third parties, e.g., to display ads or track user data without consent. Each sub-module allows to include a specific third party service in the consent management, by controlling the execution of javascript. However, this does not adequately check whether the provided JavaScript code originates from authorized users. A potential attacker would at least need permission to create and publish HTML (e.g. content or comments). Solution: Install the latest version: * If you use the COOKiES Consent Management module for Drupal 9 or above, upgrade to COOKiES Consent Management 1.2.15 [3] Reported By: * Pierre Rudloff (prudloff) [4] Fixed By: * Joachim Feltkamp (jfeltkamp) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team * Cathy Theys (yesct) [8] of the Drupal Security Team [1] https://www.drupal.org/project/cookies [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/cookies/releases/1.2.15 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/jfeltkamp [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/poker10 [8] https://www.drupal.org/u/yesct

1 0

COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-075
by security-news＠drupal.org 28 May '25

28 May '25

View online: https://www.drupal.org/sa-contrib-2025-075 Project: COOKiES Consent Management [1] Date: 2025-May-28 Security risk: *Moderately critical* 12 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Affected versions: <1.2.15 CVE IDs: CVE-2025-48914 Description: This module provides a format filter, which allows you to "disable" certain HTML elements (e.g. remove their src attribute) specified by the user. These elements will be enabled again, once the COOKiES banner is accepted. The module doesn't sufficiently check whether to convert "data-src" attributes to "src" when their value might contain malicious content under the scenario, that module specific classes are set on the HTML element. This vulnerability is mitigated by the fact that the site must have the COOKiES filter submodule enabled and an attacker must have the correct permissions to have a specific HTML element display for all users, and this HTML element needs to have three concise classes set. Solution: Install the latest version: * If you use the COOKiES Consent Management module for Drupal 9 or above, upgrade to COOKiES Consent Management 1.2.15 [3] Reported By: * Pierre Rudloff (prudloff) [4] Fixed By: * Julian Pustkuchen (anybody) [5] * Joshua Sedler (grevil) [6] * Joachim Feltkamp (jfeltkamp) [7] Coordinated By: * Juraj Nemec (poker10) [8] of the Drupal Security Team * Cathy Theys (yesct) [9] of the Drupal Security Team [1] https://www.drupal.org/project/cookies [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/cookies/releases/1.2.15 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/anybody [6] https://www.drupal.org/u/grevil [7] https://www.drupal.org/u/jfeltkamp [8] https://www.drupal.org/u/poker10 [9] https://www.drupal.org/u/yesct

1 0

etracker - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-074
by security-news＠drupal.org 28 May '25

28 May '25

View online: https://www.drupal.org/sa-contrib-2025-074 Project: etracker [1] Date: 2025-May-28 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Scripting Affected versions: <3.1.0 CVE IDs: CVE-2025-48920 Description: The module adds the etracker web statistics tracking system to your website. The cookies_etracker submodule allows the inline JavaScript to be included in consent management. However, this does not adequately check whether the provided JavaScript code originates from authorized users. A potential attacker would at least need permission to create and publish HTML (e.g. content or comments). Solution: Install the latest version: * If you use the etracker module for Drupal 9 and above, upgrade to etracker 8.x-3.1 [3] Reported By: * Pierre Rudloff (prudloff) [4] Fixed By: * Julian Pustkuchen (anybody) [5] * Sven Schüring (sunlix) [6] Coordinated By: * Juraj Nemec (poker10) [7] of the Drupal Security Team * Pierre Rudloff (prudloff) [8] * Cathy Theys (yesct) [9] of the Drupal Security Team [1] https://www.drupal.org/project/etracker [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/etracker/releases/8.x-3.1 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/anybody [6] https://www.drupal.org/u/sunlix [7] https://www.drupal.org/u/poker10 [8] https://www.drupal.org/u/prudloff [9] https://www.drupal.org/u/yesct

1 0

Simple Klaro - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-073
by security-news＠drupal.org 28 May '25

28 May '25

View online: https://www.drupal.org/sa-contrib-2025-073 Project: Simple Klaro [1] Date: 2025-May-28 Security risk: *Moderately critical* 13 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Affected versions: <1.10.0 CVE IDs: CVE-2025-48919 Description: The "Simple Klaro" module adds the "Klaro! A Simple Consent Manager" to your website and allows you to configure it according to your needs in the Drupal backend. The module doesn't sufficiently sanitise data attributes allowing persistent Cross Site Scripting (XSS) attacks. This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes. Solution: Install the latest version: * If you use the "Simple Klaro" module for Drupal 9.x/10.x/11.x, upgrade to Simple Klaro 1.10.0 [3] Reported By: * Pierre Rudloff (prudloff) [4] Fixed By: * Norman Kämper-Leymann (norman.lol) [5] Coordinated By: * Juraj Nemec (poker10) [6] of the Drupal Security Team * Pierre Rudloff (prudloff) [7] * Cathy Theys (yesct) [8] of the Drupal Security Team [1] https://www.drupal.org/project/simple_klaro [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/simple_klaro/releases/1.10.0 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/normanlol [6] https://www.drupal.org/u/poker10 [7] https://www.drupal.org/u/prudloff [8] https://www.drupal.org/u/yesct

1 0

EU Cookie Compliance (GDPR Compliance) - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-072
by security-news＠drupal.org 28 May '25

28 May '25

View online: https://www.drupal.org/sa-contrib-2025-072 Project: EU Cookie Compliance (GDPR Compliance) [1] Date: 2025-May-28 Security risk: *Moderately critical* 13 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Affected versions: <1.26.0 CVE IDs: CVE-2025-48917 Description: This module addresses the General Data Protection Regulation (GDPR) and the EU Directive on Privacy and Electronic Communications. The module doesn't sufficiently verify whether "disabled JavaScript" entries are valid or correspond to actual scripts on the page. As a result, an attacker could inject and execute arbitrary JavaScript by adding invalid or non-existent entries, which the module then attempts to process. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer EU Cookie Compliance banner". Solution: Install the latest version: * If you use EU Cookie Compliance (GDPR Compliance) module for Drupal 10+, upgrade to EU Cookie Compliance (GDPR Compliance) 8.x-1.26 [3] Reported By: * Pierre Rudloff (prudloff) [4] Fixed By: * Grant McEwan (atowl) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team * Cathy Theys (yesct) [8] of the Drupal Security Team [1] https://www.drupal.org/project/eu_cookie_compliance [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/eu_cookie_compliance/releases/8.x-1.26 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/atowl [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/poker10 [8] https://www.drupal.org/u/yesct

1 0

Simple Klaro - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-071
by security-news＠drupal.org 28 May '25

28 May '25

View online: https://www.drupal.org/sa-contrib-2025-071 Project: Simple Klaro [1] Date: 2025-May-28 Security risk: *Moderately critical* 13 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Affected versions: <1.10.0 CVE IDs: CVE-2025-48918 Description: The "Simple Klaro" module adds the "Klaro! A Simple Consent Manager" to your website and allows you to configure it according to your needs in the Drupal backend. The module doesn't sufficiently mark its administrative permission as restricted, creating the possibility for the permission to be granted too broadly. A malicious admin could execute a Cross Site Scripting (XSS) attack. This vulnerability is mitigated by the fact that an attacker must have a role with the "administer simple klaro" permission. Solution: Install the latest version: * If you use the "Simple Klaro" module for Drupal 9.x/10.x/11.x, upgrade to Simple Klaro 1.10.0 [3] Reported By: * Pierre Rudloff (prudloff) [4] Fixed By: * Norman Kämper-Leymann (norman.lol) [5] Coordinated By: * Juraj Nemec (poker10) [6] of the Drupal Security Team * Pierre Rudloff (prudloff) [7] * Cathy Theys (yesct) [8] of the Drupal Security Team [1] https://www.drupal.org/project/simple_klaro [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/simple_klaro/releases/1.10.0 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/normanlol [6] https://www.drupal.org/u/poker10 [7] https://www.drupal.org/u/prudloff [8] https://www.drupal.org/u/yesct

1 0