PT-2025-2104 · Unknown · Cookiebot + Gtm

Cathy Theys + 3 · Published 2024-10-30 · Updated 2025-09-02 · CVE-2024-13289

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cookiebot + GTM versions 0.0.0 through 1.0.17

Description The issue is related to improper neutralization of input during web page generation, also known as Cross-site Scripting (XSS). This allows an attacker to conduct Cross-Site Scripting attacks. The vulnerability is associated with the failure to protect the structure of web pages.

Recommendations For versions 0.0.0 through 1.0.17, update to version 1.0.18 or later to resolve the issue. As a temporary workaround, consider restricting access to vulnerable components until a patch is available. Avoid using potentially vulnerable API endpoints or parameters that may be susceptible to Cross-Site Scripting attacks until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-01168

CVE-2024-13289

DRUPAL-CONTRIB-2024-055

Affected Products

Cookiebot + Gtm

References · 7

• https://osv.dev/vulnerability/CVE-2024-13289 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-01168 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-13289 · Security Note
• https://t.me/cveNotify/134117 · Telegram Post
• https://drupal.org/sa-contrib-2024-055 · Note
• https://twitter.com/VulmonFeeds/status/1877748317859217897 · Twitter Post
• https://twitter.com/CVEnew/status/1877620685205590246 · Twitter Post