[Security-news] Tarte au Citron - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-064

[security-news at drupal.org]

View online: https://www.drupal.org/sa-contrib-2024-064

Project: Tarte au Citron [1]
Date: 2024-November-27
Security risk: *Moderately critical* 13 ∕ 25
AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2]
Vulnerability: Cross Site Scripting

Affected versions: <2.0.5
Description: 
This module integrates Tarte au citron JS library with Drupal and prevent
services to be loaded without user consent. Administrators can enable and
configure services which will be managed by Tarte au citron.

When Google Tag Manager (GTM) service is enabled, an attacker can load a GTM
container that can completely change the page or insert malicious JS.

This vulnerability is mitigated by the fact that the attacker must have a
role with the permission "administer tarte au citron".

Solution: 
Install the latest version and confirm only trusted roles have the
"Administer Tarte au citron" permission.

   * If you use the Tarte au citron module for Drupal 10.x, upgrade to Tarte 
au
     citron 2.0.5 [3]

Reported By: 
   * Pierre Rudloff [4]

Fixed By: 
   * Kévin Le lostec [5]

Coordinated By: 
   * Greg Knaddison [6] of the Drupal Security Team
   * Juraj Nemec [7] of the Drupal Security Team
   * cilefen [8] of the Drupal Security Team


[1] https://www.drupal.org/project/tarte_au_citron
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/tarte_au_citron/releases/2.0.5
[4] https://www.drupal.org/user/3611858
[5] https://www.drupal.org/user/3455737
[6] https://www.drupal.org/user/36762
[7] https://www.drupal.org/user/272316
[8] https://www.drupal.org/u/cilefen