CVE-2025-7392 - Vulnerability Details - OpenCVE

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Cookies Addons allows Cross-Site Scripting (XSS).This issue affects Cookies Addons: from 1.0.0 before 1.2.4.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Cookies Addons Project	Cookies Addons

Configuration 1 [-]

cpe:2.3:a:cookies_addons_project:cookies_addons:*:*:*:*:*:drupal:*:*

No data.

References

Link	Providers
https://www.drupal.org/sa-contrib-2025-087

History

Wed, 27 Aug 2025 14:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Cookies Addons Project Cookies Addons Project cookies Addons
CPEs		cpe:2.3:a:cookies_addons_project:cookies_addons::::::drupal::*
Vendors & Products		Cookies Addons Project Cookies Addons Project cookies Addons

Tue, 22 Jul 2025 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 21 Jul 2025 17:00:00 +0000

Type	Values Removed	Values Added
Description		Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Cookies Addons allows Cross-Site Scripting (XSS).This issue affects Cookies Addons: from 1.0.0 before 1.2.4.
Title		Cookies Addons - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-087
Weaknesses		CWE-79
References		https://www.drupal.org/sa-contrib-2025-087

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2025-07-21T16:36:04.813Z

Updated: 2025-07-22T14:06:04.006Z

Reserved: 2025-07-09T16:03:34.228Z

Link: CVE-2025-7392

Vulnrichment

Updated: 2025-07-22T14:05:59.182Z

NVD

Status : Analyzed

Published: 2025-07-21T17:15:37.507

Modified: 2025-08-27T14:23:53.367

Link: CVE-2025-7392

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-7392", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2025-07-09T16:03:34.228Z", "datePublished": "2025-07-21T16:36:04.813Z", "dateUpdated": "2025-07-22T14:06:04.006Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.drupal.org/project/cookies_addons", "defaultStatus": "unaffected", "product": "Cookies Addons", "repo": "https://git.drupalcode.org/project/cookies_addons", "vendor": "Drupal", "versions": [{"lessThan": "1.2.4", "status": "affected", "version": "1.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Pierre Rudloff (prudloff)"}, {"lang": "en", "type": "remediation developer", "value": "Guido Schmitz (guido_s)"}, {"lang": "en", "type": "remediation developer", "value": "Kostia Bohach (_shy)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Pierre Rudloff (prudloff)"}], "datePublic": "2025-07-09T16:37:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Cookies Addons allows Cross-Site Scripting (XSS).<p>This issue affects Cookies Addons: from 1.0.0 before 1.2.4.</p>"}], "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Cookies Addons allows Cross-Site Scripting (XSS).This issue affects Cookies Addons: from 1.0.0 before 1.2.4."}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-07-21T16:36:04.813Z"}, "references": [{"url": "https://www.drupal.org/sa-contrib-2025-087"}], "source": {"discovery": "UNKNOWN"}, "title": "Cookies Addons - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-087", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-07-22T14:05:33.219308Z", "id": "CVE-2025-7392", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-22T14:06:04.006Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-7392", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-22T14:05:33.219308Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-22T14:05:59.182Z"}}], "cna": {"title": "Cookies Addons - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-087", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Pierre Rudloff (prudloff)"}, {"lang": "en", "type": "remediation developer", "value": "Guido Schmitz (guido_s)"}, {"lang": "en", "type": "remediation developer", "value": "Kostia Bohach (_shy)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Pierre Rudloff (prudloff)"}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/cookies_addons", "vendor": "Drupal", "product": "Cookies Addons", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "1.2.4", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/cookies_addons", "defaultStatus": "unaffected"}], "datePublic": "2025-07-09T16:37:00.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2025-087"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Cookies Addons allows Cross-Site Scripting (XSS).This issue affects Cookies Addons: from 1.0.0 before 1.2.4.", "supportingMedia": [{"type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Cookies Addons allows Cross-Site Scripting (XSS).<p>This issue affects Cookies Addons: from 1.0.0 before 1.2.4.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-07-21T16:36:04.813Z"}}}, "cveMetadata": {"cveId": "CVE-2025-7392", "state": "PUBLISHED", "dateUpdated": "2025-07-22T14:06:04.006Z", "dateReserved": "2025-07-09T16:03:34.228Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2025-07-21T16:36:04.813Z", "assignerShortName": "drupal"}, "dataVersion": "5.1"}