PT-2025-21519 · Unknown · Webtoffee-Gdpr-Cookie-Consent

Zitec/Teodora Jilaveanu · Published 2025-05-15 · Updated 2025-06-12 · CVE-2024-8397

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: webtoffee-gdpr-cookie-consent versions prior to 2.6.1

Description: The issue allows visitors to conduct Stored Cross-Site Scripting attacks due to improper sanitization and escaping of IP headers when logging them. The payload is triggered when an administrator visits the "Consent report" page, and the malicious script is executed in the administrator's context.

Recommendations: For versions prior to 2.6.1, update to version 2.6.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the "Consent report" page until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-8397

Affected Products

Webtoffee-Gdpr-Cookie-Consent

References · 5

• 🔥 https://wpscan.com/vulnerability/847fbf5d-f7cf-49fd-88bc-d7fa2a8110bd · Exploit
• https://osv.dev/vulnerability/CVE-2024-8397 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8397 · Security Note
• https://twitter.com/CVEnew/status/1923119315970294265 · Twitter Post
• https://t.me/cvenotify/125507 · Telegram Post