CVE-2025-47704 in Klaro Cookie & Consent Management
Summary
by MITRE • 05/14/2025
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Klaro Cookie & Consent Management allows Cross-Site Scripting (XSS).This issue affects Klaro Cookie & Consent Management: from 0.0.0 before 3.0.5.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 06/10/2025
The vulnerability identified as CVE-2025-47704 represents a critical cross-site scripting flaw within the Drupal Klaro Cookie & Consent Management module, classified under CWE-79 Improper Neutralization of Input During Web Page Generation. This weakness enables malicious actors to inject arbitrary JavaScript code into web pages viewed by users, potentially compromising the security of websites utilizing this consent management solution. The vulnerability specifically impacts versions of the Klaro module ranging from version 0.0.0 up to but not including 3.0.5, creating a substantial attack surface for systems that have not yet upgraded to the patched release. The flaw occurs during the web page generation process where user input is not properly sanitized or escaped before being rendered in the browser context.
The technical exploitation of this XSS vulnerability occurs when the Klaro module processes user-supplied data that is subsequently included in web page output without adequate input validation or output encoding. Attackers can craft malicious payloads that, when processed by the vulnerable module, execute within the context of other users' browsers. This allows for session hijacking, credential theft, defacement of web pages, or redirection to malicious sites. The vulnerability's impact is amplified by the nature of cookie consent management, as it typically involves user interaction and data collection processes that may be manipulated to deliver malicious scripts. The flaw represents a classic server-side XSS vector where the application fails to properly escape or validate content before rendering it to end users, creating a persistent security risk.
From an operational standpoint, this vulnerability poses significant risks to organizations relying on Drupal websites with Klaro cookie consent management. The attack surface extends beyond simple script execution to include potential data breaches, as attackers could exploit the XSS to access sensitive user information or manipulate cookie consent settings. The vulnerability affects the integrity and availability of web applications by potentially disrupting legitimate user sessions and compromising the trust users place in the website's cookie management system. Security teams face the challenge of identifying affected systems and implementing immediate remediation measures, as the vulnerability could be exploited by automated scanning tools or targeted attackers. The impact is particularly severe given that cookie consent management systems are often integrated into critical website functionality and user experience flows.
Mitigation strategies for CVE-2025-47704 should prioritize immediate upgrade to Klaro Cookie & Consent Management version 3.0.5 or later, which contains the necessary patches to address the XSS vulnerability. Organizations should also implement additional security controls such as Content Security Policy (CSP) headers to provide defense-in-depth against potential exploitation attempts. Input validation and output encoding mechanisms should be strengthened across all user-facing components, particularly those handling cookie consent data. Security monitoring should include detection of suspicious script injection attempts and anomalous user behavior patterns that may indicate exploitation. The vulnerability aligns with ATT&CK technique T1531 Credential Access through web application exploitation, and organizations should consider implementing web application firewalls to detect and block malicious payloads targeting this specific XSS vector. Regular security assessments and dependency updates should be part of ongoing security operations to prevent similar vulnerabilities from emerging in other components of the web application stack.