CVE-2024-47069: Oveleon Cookiebar

Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days.

Oveleon Cookie Bar is a cookie bar is for the Contao Open Source CMS and allows a visitor to define cookie & privacy settings for the website. Prior to versions 1.16.3 and 2.1.3, the `block/locale` endpoint does not properly sanitize the user-controlled `locale` input before including it in the backend's HTTP response, thereby causing reflected cross-site scripting. Versions 1.16.3 and 2.1.3 contain a patch for the vulnerability.

Affected products

• Oveleon Cookiebar: before 1.16.3 (fixed in 1.16.3); from 2.0.0, before 2.1.3 (fixed in 2.1.3)

Published 2024-09-23. Last modified 2026-06-17.