Executive brief
The Cookiecuttr module for Drupal, which manages cookie consent banners, contains a stored cross-site scripting (XSS) vulnerability in its administration interface. An attacker with the "administer cookiecuttr" permission can inject malicious scripts that are stored in the database and executed when the settings are viewed by administrators, potentially allowing account takeover or session hijacking of privileged users.
Technical details
The vulnerability exists in the Cookiecuttr administration form where user input is not properly sanitized before storage and rendering. An authenticated attacker with the "administer cookiecuttr" permission can inject JavaScript through form fields that is later executed in the browser of any administrator viewing those settings. This is a stored XSS requiring administrative role permissions and affects versions 2.0.0 through 2.0.2.
Affected products
- Drupal Cookiecuttr 2.0.0 to 2.0.2