CVE-2024-47069

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Oveleon Cookie Bar is a cookie bar is for the Contao Open Source CMS and allows a visitor to define cookie & privacy settings for the website. Prior to versions 1.16.3 and 2.1.3, the `block/locale` endpoint does not properly sanitize the user-controlled `locale` input before including it in the backend's HTTP response, thereby causing reflected cross-site scripting. Versions 1.16.3 and 2.1.3 contain a patch for the vulnerability.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
oveleon	contao-cookiebar	< 1.16.3; >= 2.0.0, < 2.1.3
oveleon	contao-cookiebar	< 1.16.3; >= 2.0.0, < 2.1.3

References

Timeline

Published: Sep 23, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-47075.4The Materialis Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's materialis_contact_form shortcod CVE-2024-470709.0authentik is an open-source identity provider. A vulnerability that exists in versions prior to 2024.8.3 and 2024.6.5 allows bypassing passw CVE-2024-470716.8OSS Endpoint Manager is an endpoint manager module for FreePBX. OSS Endpoint Manager module activation can allow authenticated web users una CVE-2024-470727.5XStream is a simple library to serialize objects to XML and back again. This vulnerability may allow a remote attacker to terminate the appl CVE-2024-470739.1DataEase is an open source data visualization analysis tool that helps users quickly analyze data and gain insights into business trends. In CVE-2024-470749.8DataEase is an open source data visualization analysis tool. In Dataease, the PostgreSQL data source in the data source function can customi CVE-2024-470756.1LayUI is a native minimalist modular Web UI component library. Versions prior to 2.9.17 have a DOM Clobbering vulnerability that can lead to CVE-2024-470768.6CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` p CVE-2024-470776.5authentik is an open-source identity provider. Prior to versions 2024.8.3 and 2024.6.5, access tokens issued to one application can be stole CVE-2024-470789.8Meshtastic is an open source, off-grid, decentralized, mesh network. Meshtastic uses MQTT to communicate over an internet connection to a sh CVE-2024-470796.4Meshtastic is an open source, off-grid, decentralized, mesh network built to run on affordable, low-power devices. Meshtastic firmware is an CVE-2024-47089.8mySCADA myPRO uses a hard-coded password which could allow an attacker to remotely execute code on the affected device.