Cross-Site Scripting Vulnerability in Klaro Cookie & Consent Management by Drupal
CVE-2025-47704

6.1MEDIUM

Key Information:

Vendor

Drupal
Status
Klaro Cookie & Consent Management
Vendor
CVE Published:
14 May 2025

What is CVE-2025-47704?

A Cross-Site Scripting (XSS) vulnerability exists in the Klaro Cookie & Consent Management tool due to improper neutralization of user input during web page generation. This vulnerability affects versions from 0.0.0 up to, but not including, 3.0.5, allowing malicious actors to inject arbitrary scripts into web pages viewed by users. Exploitation of this XSS issue could lead to unauthorized access to sensitive information and web session hijacking, posing significant security risks to websites utilizing the affected product.

Affected Version(s)

Klaro Cookie & Consent Management 0.0.0 < 3.0.5

References

https://www.drupal.org/sa-contrib-2025-050

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Pierre Rudloff (prudloff)
Jan Kellermann (jan kellermann)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
Pierre Rudloff (prudloff)
.