Project: 
Cookiebot + GTM
Date: 
2024-October-30
Security risk: 
Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All
Vulnerability: 
Cross Site Scripting
Affected versions: 
<1.0.18
CVE IDs: 
CVE-2024-13289
Description: 

This module makes it possible for you to integrate Cookiebot and Google Tag Manager in a fast and simple way.

The module doesn't sufficiently filter for malicious script leading to a persistent cross site scripting (XSS) vulnerability.

Solution: 

Install the latest version and review settings:

  1. If you use the Cookiebot + GTM module for Drupal, upgrade to Cookiebot + GTM 1.0.18
  2. Additionally, the new codebase adds validation and permission changes so admins should re-save the configuration form at /admin/config/cookiebot_gtm and confirm which roles have permission to configure the module at /admin/people/permissions.
Reported By: 
Fixed By: 
Coordinated By: