EUVD-2025-209927
GHSA-2m22-x9h5-mq25
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:H reflects required privileged CMS role; AC:H captures mandatory YouTube service precondition; S:C and C:L/I:L reflect cross-site script execution impacting victim browsers.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
The GDPR cookies module for Backdrop CMS (before
1.x-1.3.5) doesn't sufficiently protect visitors from Cross Site Scripting (XSS) if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with the permission "Create a GDPR Cookies Service" or "Edit any GDPR Cookies Service" and a site must have added a YouTube service as configuration.
AnalysisAI
Stored Cross-Site Scripting in the GDPR Cookies module for Backdrop CMS (versions before 1.x-1.3.5) allows a privileged authenticated attacker to inject malicious script via the optional 'Info content' field of a YouTube service configuration, executing arbitrary JavaScript in the browsers of site visitors who interact with the GDPR cookie consent widget. Exploitation is heavily gated: the attacker must hold a CMS role with 'Create a GDPR Cookies Service' or 'Edit any GDPR Cookies Service' permission, and the site must have an active YouTube service configured. No public exploit exists and no active exploitation has been confirmed; EPSS is 0.04% at the 13th percentile, consistent with SSVC's 'exploitation: none' finding.
Technical ContextAI
CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page) indicates that user-supplied content is rendered in an HTML context without adequate sanitization or escaping of script-related tags. The flaw resides specifically in the rendering pipeline for the optional 'Info content' field associated with YouTube service entries in the GDPR Cookies contrib module. The CPE identifier cpe:2.3:a:backdropcms:gdpr_cookies_module_for_backdrop_cms:*:*:*:*:*:*:*:* confirms this is a third-party contributed module for Backdrop CMS - itself a community fork of Drupal 7. When the GDPR cookie consent widget is rendered on a page, the unsanitized field value is output into the HTML document, enabling stored XSS payloads to execute in any visitor's browser context rather than only the attacker's. The scope-changing nature of stored XSS (attacker writes, victim executes) explains the CVSS 4.0 subsequent-system impact metrics (SI:L, SA:L) despite no direct vulnerable-system impact.
RemediationAI
Vendor-released patch: upgrade the GDPR Cookies module for Backdrop CMS to version 1.x-1.3.5 or later, as documented in the vendor advisory at https://backdropcms.org/security/sa-contrib-2025-013. If an immediate module upgrade is not operationally feasible, administrators can reduce exposure by auditing and restricting user roles so that only fully trusted staff hold the 'Create a GDPR Cookies Service' or 'Edit any GDPR Cookies Service' permissions - this directly eliminates the attacker's required entry point, with no functional trade-off for normal site visitors. Alternatively, removing all YouTube service entries from the GDPR cookie configuration eliminates the vulnerable rendering path entirely, with the trade-off of losing YouTube consent-management functionality until the patch is applied. Neither workaround substitutes for the patch and both require re-evaluation after upgrade.
Same weakness CWE-80 – Basic XSS
View allShare
External POC / Exploit Code
Leaving vuln.today