{"id":"CVE-2025-31683","aliases":["DRUPAL-CONTRIB-2025-012","EUVD-2025-9034","GHSA-qchr-8m24-7v66"],"status":"published","title":"Google Tag - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-012","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Google Tag allows Cross Site Request Forgery.This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.0018,"percentile":0.077,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352"],"published":"2025-01-29T17:16:19Z","modified":"2026-10-28T02:30:56Z","fixes":[{"ecosystem":"Packagist","package":"drupal/google_tag","fixed_in":["1.8.0","2.0.8"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/google_tag","fixed_in":["1.8.0","2.0.8"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"drupal/google_tag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"drupal/google_tag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.8"}]}]},{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/google_tag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0"}]},{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.8"}]}]},{"source":"osv","ecosystem":"Packagist","package":"drupal/google_tag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0"}]}]},{"source":"osv","ecosystem":"Packagist","package":"drupal/google_tag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.8"}]}]}],"products":[{"vendor":"drupal","product":"google tag"},{"vendor":"google_tag_project","product":"google_tag"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2025-012","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31683","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qchr-8m24-7v66"},{"url":"https://git.drupalcode.org/project/google_tag","tags":["web","package"]},{"url":"https://www.drupal.org/project/google_tag","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31683.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-31683","title":"Google Tag - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-012","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Google Tag allows Cross Site Request Forgery.This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.","status":"published","published":"2025-03-31T21:41:01.996Z","modified":"2025-04-29T15:33:53.583Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:32:44.763463Z"}],"euvd":[{"id":"EUVD-2025-9034","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Google Tag allows Cross Site Request Forgery.This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.","status":"published","published":"2025-03-31T21:41:01Z","modified":"2025-04-29T15:33:53Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T20:52:00.449871Z"}],"ghsa":[{"id":"GHSA-qchr-8m24-7v66","title":"Drupal Google Tag Cross-Site Request Forgery (CSRF)","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Google Tag allows Cross Site Request Forgery. This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.","status":"published","published":"2025-04-01T00:30:34Z","modified":"2025-04-29T20:19:48Z","cvss":[{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:38:41.402125Z"}],"nvd":[{"id":"CVE-2025-31683","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Google Tag allows Cross Site Request Forgery.This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.","status":"published","published":"2025-03-31T22:15:20.89Z","modified":"2026-06-17T09:10:46.047Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:10:57.134561Z"}],"osv":[{"id":"CVE-2025-31683","title":"Google Tag - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-012","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Google Tag allows Cross Site Request Forgery.This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.","status":"published","published":"2025-03-31T21:41:01.996Z","modified":"2026-10-28T02:30:56.779873986Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:44:48.02508Z"},{"id":"GHSA-qchr-8m24-7v66","title":"Drupal Google Tag Cross-Site Request Forgery (CSRF)","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Google Tag allows Cross Site Request Forgery. This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.","status":"published","published":"2025-04-01T00:30:34Z","modified":"2025-12-10T23:41:02.459218Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"medium"},{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:46:54.40888Z"},{"id":"DRUPAL-CONTRIB-2025-012","description":"This module enables you to integrate the site with the Google Tag Manager (GTM) application.\n\nThe module doesn't sufficiently validate the enabling or disabling of a tag container. The routes involved are not protected against Cross Site Request Forgery (CSRF).\n\nThis vulnerability is mitigated by the fact that an attacker needs to know the machine name of the container. The machine name is a random string, making an attack more difficult.","status":"published","published":"2025-01-29T17:16:19Z","modified":"2026-09-10T03:45:54.597048249Z","updated_at":"2026-11-02T15:46:13.584509Z"}]}}