DRUPAL-CONTRIB-2023-021
CivicCookieControl is a module that can help make a website compliant with EU and UK cookie legislation.
The Civic GovUK Cookie Control module does not sufficiently sanitize the configuration resulting in a Cross-Site Scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that the attacker must have a role with the "Administer Civic Cookie Control" permission.
What each source reports
OSV No score
CivicCookieControl is a module that can help make a website compliant with EU and UK cookie legislation.
The Civic GovUK Cookie Control module does not sufficiently sanitize the configuration resulting in a Cross-Site Scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that the attacker must have a role with the "Administer Civic Cookie Control" permission.
- Record
DRUPAL-CONTRIB-2023-021- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/civicccookiecontrolPackagist:https://packages.drupal.org/8 |
before 4.4.13 | 4.4.13 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
DRUPAL-CONTRIB-2023-021 is a vulnerability with no CVSS score yet in drupal/civicccookiecontrol, published June 21, 2023. No source lists public exploit code. Fixed in drupal/civicccookiecontrol 4.4.13.