CVE-2025-71310
BaseFortify
Publication date: 2026-05-26
Last updated on: 2026-05-26
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| backdrop | gdpr_cookies | to 1.x-1.3.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-80 | The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in the GDPR Cookies module for Backdrop CMS allows for a Cross Site Scripting (XSS) attack if a malicious value is provided in the 'Info content' field for the YouTube service configuration. However, exploitation requires an attacker to have specific permissions and the site to have a YouTube service configured.
While the vulnerability relates to a module designed to help with GDPR compliance, the provided information does not explicitly describe how this vulnerability impacts compliance with GDPR, HIPAA, or other common standards and regulations.
Can you explain this vulnerability to me?
The GDPR Cookies module for Backdrop CMS versions before 1.x-1.3.5 has a Cross Site Scripting (XSS) vulnerability. This occurs when a malicious value is entered into the optional 'Info content' field for the YouTube service configuration.
To exploit this vulnerability, an attacker must have a role with the permission to either create or edit a GDPR Cookies Service, and the site must have a YouTube service configured.
This vulnerability allows an attacker to inject malicious scripts, but it is considered less critical due to the required permissions and configuration.
How can this vulnerability impact me? :
If exploited, this vulnerability could allow an attacker with sufficient permissions to execute malicious scripts within the context of the website.
This could potentially lead to unauthorized actions or data exposure affecting site visitors or administrators.
However, the impact is limited because the attacker must already have elevated permissions and the site must have a specific configuration.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves a Cross Site Scripting (XSS) issue in the GDPR Cookies module for Backdrop CMS when a malicious value is provided in the optional 'Info content' field for the YouTube service configuration.
Detection would require checking if your Backdrop CMS installation uses the GDPR Cookies module prior to version 1.x-1.3.5 and if a YouTube service is configured.
Since exploitation requires specific permissions ('Create a GDPR Cookies Service' or 'Edit any GDPR Cookies Service'), you should audit user roles and permissions for these capabilities.
There are no specific commands provided in the available resources to detect this vulnerability on your network or system.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade the GDPR Cookies module for Backdrop CMS to version 1.x-1.3.5 or later, where this vulnerability has been fixed.
Additionally, review and restrict user roles to ensure that only trusted users have the permissions 'Create a GDPR Cookies Service' or 'Edit any GDPR Cookies Service'.
If a YouTube service is not required, consider removing it from the GDPR Cookies configuration to reduce the attack surface.