[Security-news] TacJS - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-016

[security-news at drupal.org]

View online: https://www.drupal.org/sa-contrib-2024-016

Project: TacJS [1]
Date: 2024-March-27
Security risk: *Moderately critical* 14∕25
AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2]
Vulnerability: Cross Site Scripting

Affected versions: <6.5.0
Description: 
This module enables sites to comply with the European cookie law using
tarteaucitron.js.

The module doesn't sufficiently filter user-supplied markup inside of content
leading to a persistent Cross Site Scripting (XSS) vulnerability. More
details are available in CVE-2023-3620 [3].

This vulnerability is mitigated by the fact that an attacker needs to be able
to write content in the page, a feature commonly available on Drupal sites.

Solution: 
Install the latest version:

   * If you use the tacjs module for Drupal 8.x, upgrade to tacjs 8.x-6.5 [4]

Reported By: 
   * Pierre Rudloff [5]

Fixed By: 
   * Frank Mably [6]
   * Pierre Rudloff [7]

Coordinated By: 
   * Greg Knaddison [8] of the Drupal Security Team


[1] https://www.drupal.org/project/tacjs
[2] https://www.drupal.org/security-team/risk-levels
[3] https://nvd.nist.gov/vuln/detail/CVE-2023-3620
[4] https://www.drupal.org/project/tacjs/releases/8.x-6.5
[5] https://www.drupal.org/user/3611858
[6] https://www.drupal.org/user/3375160
[7] https://www.drupal.org/user/3611858
[8] https://www.drupal.org/user/36762