Date: 
Wednesday, Feb 12th, 2025
Advisory ID: 
BACKDROP-SA-CONTRIB-2025-002
Security risk: 
Less Critical
Vulnerability: 
Cross Site Scripting
CVE ID: 
CVE-2023-3620
Versions affected: 
  • GDPR cookies module, 1.x versions prior to 1.x-1.3.3.

 

Description: 

The GDPR cookies module contains a library with known vulnerabilities:

tarteaucitronjs is a package that provides compliance to the European cookie law.  Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to missing sanitization of the services attributes value, and improper user-input sanitization, via width, theme, controls, img and other attributes.

Solution: 

Upgrade your site to the most recent version of the GDPR cookies module. Download available on the GDPR cookies module page.

Reported By: 
Fixed By: 

Security email list

Backdrop maintains a security mailing list. Whenever a security release comes out, an email will be sent to everyone subscribed to that list, announcing the new release. Please follow the steps below to join the Security email list.

  1. Log in to backdropcms.org
  2. Edit your profile
  3. Switch to the "Subscriptions" tab
  4. Check the box labeled "Security updates"
  5. Save the form