The Drupal GoogleTag Manager has a vulnerability due to improper neutralization of input during web page generation, leading to Cross-Site Scripting (XSS). This issue affects versions from 0.0.0 up to 1.10.0. Attackers can exploit this vulnerability to execute arbitrary scripts in the context of the user’s session.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.3 | CVE-2025-8362 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious input that is processed by the Drupal GoogleTag Manager. This input can be injected into web pages, allowing the attacker to execute scripts in the context of the user’s session, potentially leading to data theft or session hijacking.
Affected Products
- GoogleTag Manager: Affected from version 0.0.0 to 1.10.0, this product allows users to manage JavaScript and HTML tags used for tracking and analytics on websites.
Mitigation
To mitigate this vulnerability, users should upgrade their Drupal GoogleTag Manager to version 1.10.0 or later. Additionally, implementing input validation and sanitization can help prevent XSS attacks.