{"self":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2025-47703","first":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2025-47703\u0026page=0","last":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2025-47703\u0026page=0","list":[{"field_issue_status":"7","field_project":{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3139023","id":"3139023","resource":"node"},"field_sa_advisory_id":"049","field_sa_coordinated_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/greggles\u0022 rel=\u0022nofollow\u0022\u003EGreg Knaddison (greggles)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/poker10\u0022 rel=\u0022nofollow\u0022\u003EJuraj Nemec (poker10)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_criticality":"AC:Basic\/A:User\/CI:Some\/II:Some\/E:Theoretical\/TD:Default","field_sa_description":{"value":"\u003Cp\u003EThe COOKIES module protects users from executing JavaScript code provided by third parties, e.g., to display ads or track user data without consent.\u003C\/p\u003E\n\u003Cp\u003EThe cookies_asset_injector module (a sub-module of the COOKiES module) also allows inline JavaScript to be included in consent management. However, this does not adequately check whether the provided JavaScript code originates from authorized users.\u003C\/p\u003E\n\u003Cp\u003EA potential attacker would at least need permission to create and publish HTML (e.g. content or comments).\u003C\/p\u003E","format":"1"},"field_sa_fixed_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/jfeltkamp\u0022 rel=\u0022nofollow\u0022\u003EJoachim Feltkamp (jfeltkamp)\u003C\/a\u003E\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_reported_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/prudloff\u0022 rel=\u0022nofollow\u0022\u003EPierre Rudloff (prudloff)\u003C\/a\u003E Provisional Member of the Drupal Security Team\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_solution":{"value":"\u003Cp\u003EInstall the latest version:\u003C\/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EIf you use the COOKiES Consent Management module for Drupal 9 or above, upgrade to \u003Ca href=\u0022https:\/\/www.drupal.org\/project\/cookies\/releases\/1.2.14\u0022 rel=\u0022nofollow\u0022\u003ECOOKiES Consent Management 1.2.14\u003C\/a\u003E\u003C\/li\u003E\n\u003C\/ul\u003E","format":"1"},"field_sa_type":"Cross Site Scripting","field_issue_last_status_change":"1748542800","field_sa_cve":["CVE-2025-47703"],"field_is_psa":"0","field_affected_versions":"\u003C1.2.14","field_fixed_in":[{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3522750","id":"3522750","resource":"node"},{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3522752","id":"3522752","resource":"node"}],"nid":"3523226","vid":"14010385","is_new":false,"type":"sa","title":"COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-049","language":"en","url":"https:\/\/www.drupal.org\/sa-contrib-2025-049","edit_url":"https:\/\/www.drupal.org\/node\/3523226\/edit","status":"1","promote":"0","sticky":"0","created":"1746637596","changed":"1748542800","author":{"uri":"https:\/\/www.drupal.org\/api-d7\/user\/406161","id":"406161","resource":"user","name":"Drupal Security Team"},"comment":"0","comments":[{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16099879","id":16099879,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16099880","id":16099880,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16099881","id":16099881,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16099882","id":16099882,"resource":"comment"}],"comment_count":0,"comment_count_new":false,"body":[],"feeds_item_guid":null,"feeds_item_url":null,"feed_nid":null,"flag_flag_tracker_follow_user":[],"flag_tracker_follower_count":null,"has_new_content":null,"last_comment_timestamp":"1746637596"}]}