[Security-news] TacJS - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-016
security-news at drupal.org
security-news at drupal.org
Wed Mar 27 18:03:20 UTC 2024
View online: https://www.drupal.org/sa-contrib-2024-016
Project: TacJS [1]
Date: 2024-March-27
Security risk: *Moderately critical* 14∕25
AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2]
Vulnerability: Cross Site Scripting
Affected versions: <6.5.0
Description:
This module enables sites to comply with the European cookie law using
tarteaucitron.js.
The module doesn't sufficiently filter user-supplied markup inside of content
leading to a persistent Cross Site Scripting (XSS) vulnerability. More
details are available in CVE-2023-3620 [3].
This vulnerability is mitigated by the fact that an attacker needs to be able
to write content in the page, a feature commonly available on Drupal sites.
Solution:
Install the latest version:
* If you use the tacjs module for Drupal 8.x, upgrade to tacjs 8.x-6.5 [4]
Reported By:
* Pierre Rudloff [5]
Fixed By:
* Frank Mably [6]
* Pierre Rudloff [7]
Coordinated By:
* Greg Knaddison [8] of the Drupal Security Team
[1] https://www.drupal.org/project/tacjs
[2] https://www.drupal.org/security-team/risk-levels
[3] https://nvd.nist.gov/vuln/detail/CVE-2023-3620
[4] https://www.drupal.org/project/tacjs/releases/8.x-6.5
[5] https://www.drupal.org/user/3611858
[6] https://www.drupal.org/user/3375160
[7] https://www.drupal.org/user/3611858
[8] https://www.drupal.org/user/36762
More information about the Security-news
mailing list