CVE-2025-5682
BaseFortify
Publication date: 2025-06-26
Last updated on: 2025-07-09
Assigner: Drupal.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| klaro_cookie_\&_consent_management_project | klaro_cookie_\&_consent_management | to 3.0.7 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-5682 is a persistent Cross-site Scripting (XSS) vulnerability in the Klaro Cookie & Consent Management module for Drupal. It occurs because the module does not properly sanitize certain HTML attributes, allowing an attacker with the right permissions to inject malicious scripts into web pages. To exploit this, an attacker must have a role that permits entering HTML tags with specific attributes. This vulnerability affects all versions before 3.0.7. [1]
How can this vulnerability impact me? :
This vulnerability can allow an attacker with appropriate permissions to inject malicious scripts into web pages managed by the Klaro Cookie & Consent Management module. This could lead to unauthorized actions performed in the context of a user's browser, potentially compromising user data or session information. However, exploitation requires the attacker to have specific permissions, and the overall risk is considered moderately critical. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves checking the version of the Klaro Cookie & Consent Management module installed on your Drupal system. If the version is prior to 3.0.7, it is vulnerable. Additionally, monitoring for unusual HTML input or script injection attempts in user inputs with roles that allow HTML tag entry may help detect exploitation attempts. Specific commands are not provided in the resources. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade the Klaro Cookie & Consent Management module to version 3.0.7 or later. This update contains the fix for the Cross-site Scripting vulnerability. Also, review user roles and permissions to restrict the ability to enter HTML tags with specific attributes to trusted users only. [1]