View online: https://www.drupal.org/sa-contrib-2024-055
Project: Cookiebot + GTM [1] Date: 2024-October-30 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting
Affected versions: <1.0.18 Description: This module makes it possible for you to integrate Cookiebot and Google Tag Manager in a fast and simple way.
The module doesn't sufficiently filter for malicious script leading to a persistent cross site scripting (XSS) vulnerability.
Solution: Install the latest version and review settings:
1) If you use the Cookiebot + GTM module for Drupal, upgrade to Cookiebot + GTM 1.0.18 [3] 2) Additionally, the new codebase adds validation and permission changes so admins should re-save the configuration form at /admin/config/cookiebot_gtm and confirm which roles have permission to configure the module at /admin/people/permissions.
Reported By: * Pierre Rudloff [4]
Fixed By: * Fabian de Rijk [5]
Coordinated By: * Greg Knaddison [6] of the Drupal Security Team * Juraj Nemec [7] of the Drupal Security Team * Cathy Theys [8] of the Drupal Security Team
[1] https://www.drupal.org/project/cookiebot_gtm [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/cookiebot_gtm/releases/1.0.18 [4] https://www.drupal.org/user/3611858 [5] https://www.drupal.org/user/278745 [6] https://www.drupal.org/user/36762 [7] https://www.drupal.org/user/272316 [8] https://www.drupal.org/u/yesct