CVE-2025-71310

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-71310", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-05-26T01:06:55.112Z", "datePublished": "2026-05-26T01:06:55.755Z", "dateUpdated": "2026-05-26T12:29:15.986Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "GDPR cookies module for Backdrop CMS", "repo": "https://github.com/backdrop-contrib/gdpr_cookies", "vendor": "BackdropCMS", "versions": [{"lessThan": "1.x-1.3.5", "status": "affected", "version": "0", "versionType": "custom"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "an attacker must have a role with the permission \"Create a GDPR Cookies Service\" or \"Edit any GDPR Cookies Service\", and a site must have added a xc.<br>"}], "value": "an attacker must have a role with the permission \"Create a GDPR Cookies Service\" or \"Edit any GDPR Cookies Service\", and a site must have added a xc."}], "descriptions": [{"lang": "en", "value": "The GDPR cookies module for Backdrop CMS (before \n\n1.x-1.3.5) doesn't sufficiently protect visitors from Cross Site Scripting (XSS) if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with the permission \"Create a GDPR Cookies Service\" or \"Edit any GDPR Cookies Service\" and a site must have added a YouTube service as configuration."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 1.8, "baseSeverity": "LOW", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:L", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-80", "description": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-05-26T01:06:55.755Z"}, "references": [{"url": "https://backdropcms.org/security/sa-contrib-2025-013"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Upgrade to the latest release of the GDPR Cookies module."}], "value": "Upgrade to the latest release of the GDPR Cookies module."}], "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Remove the permission \"Create a GDPR Cookies Service\" or \"Edit any GDPR Cookies Service\", from all roles, or remove the YouTube service as configuration."}], "value": "Remove the permission \"Create a GDPR Cookies Service\" or \"Edit any GDPR Cookies Service\", from all roles, or remove the YouTube service as configuration."}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-26T12:29:08.953019Z", "id": "CVE-2025-71310", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-26T12:29:15.986Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-71310", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-26T12:29:08.953019Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-26T12:29:13.237Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 1.8, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:L", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/backdrop-contrib/gdpr_cookies", "vendor": "BackdropCMS", "product": "GDPR cookies module for Backdrop CMS", "versions": [{"status": "affected", "version": "0", "lessThan": "1.x-1.3.5", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to the latest release of the GDPR Cookies module.", "supportingMedia": [{"type": "text/html", "value": "Upgrade to the latest release of the GDPR Cookies module.", "base64": false}]}], "references": [{"url": "https://backdropcms.org/security/sa-contrib-2025-013"}], "workarounds": [{"lang": "en", "value": "Remove the permission \"Create a GDPR Cookies Service\" or \"Edit any GDPR Cookies Service\", from all roles, or remove the YouTube service as configuration.", "supportingMedia": [{"type": "text/html", "value": "Remove the permission \"Create a GDPR Cookies Service\" or \"Edit any GDPR Cookies Service\", from all roles, or remove the YouTube service as configuration.", "base64": false}]}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "The GDPR cookies module for Backdrop CMS (before \n\n1.x-1.3.5) doesn't sufficiently protect visitors from Cross Site Scripting (XSS) if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with the permission \"Create a GDPR Cookies Service\" or \"Edit any GDPR Cookies Service\" and a site must have added a YouTube service as configuration."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-80", "description": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"}]}], "configurations": [{"lang": "en", "value": "an attacker must have a role with the permission \"Create a GDPR Cookies Service\" or \"Edit any GDPR Cookies Service\", and a site must have added a xc.", "supportingMedia": [{"type": "text/html", "value": "an attacker must have a role with the permission \"Create a GDPR Cookies Service\" or \"Edit any GDPR Cookies Service\", and a site must have added a xc.<br>", "base64": false}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-05-26T01:06:55.755Z"}}}, "cveMetadata": {"cveId": "CVE-2025-71310", "state": "PUBLISHED", "dateUpdated": "2026-05-26T12:29:15.986Z", "dateReserved": "2026-05-26T01:06:55.112Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-05-26T01:06:55.755Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "GDPR cookies module for Backdrop CMS", "repo": "https://github.com/backdrop-contrib/gdpr_cookies", "vendor": "BackdropCMS", "versions": [{"lessThan": "1.x-1.3.5", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The GDPR cookies module for Backdrop CMS (before \n\n1.x-1.3.5) doesn't sufficiently protect visitors from Cross Site Scripting (XSS) if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with the permission \"Create a GDPR Cookies Service\" or \"Edit any GDPR Cookies Service\" and a site must have added a YouTube service as configuration."}, {"lang": "es", "value": "El m\u00f3dulo de cookies GDPR para Backdrop CMS (anterior a 1.x-1.3.5) no protege suficientemente a los visitantes de Cross Site Scripting (XSS) si se ha proporcionado un valor malicioso para el campo opcional 'Contenido de informaci\u00f3n' para el servicio de YouTube. Esto se mitiga por el hecho de que un atacante debe tener un rol con el permiso \"Crear un servicio de cookies GDPR\" o \"Editar cualquier servicio de cookies GDPR\" y un sitio debe haber a\u00f1adido un servicio de YouTube como configuraci\u00f3n."}], "id": "CVE-2025-71310", "lastModified": "2026-07-24T10:10:00.197", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.8, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cve@mitre.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-71310", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-26T12:29:08.953019Z", "version": "2.0.3"}}]}, "published": "2026-05-26T02:16:39.060", "references": [{"source": "cve@mitre.org", "url": "https://backdropcms.org/security/sa-contrib-2025-013"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-80"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.x-1.3.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "GDPR cookies module for Backdrop CMS", "source": "cna", "vendor": "BackdropCMS"}, "product": "gdpr_cookies_module_for_backdrop_cms", "vendor": "backdropcms"}], "created": "2026-05-26T03:00:14.754557+00:00", "title": "Cross\u2011Site Scripting via YouTube Service Info Content in BackdropCMS GDPR Cookies Module", "updated": "2026-05-26T12:59:44.128626+00:00", "vendors": ["backdropcms", "backdropcms$PRODUCT$gdpr_cookies_module_for_backdrop_cms"]}