CVE-2024-13252
This module enables sites to comply with the European cookie law using tarteaucitron.js. The module doesn't sufficiently filter user-supplied markup...
Original description
The description as published by the source.
This module enables sites to comply with the European cookie law using tarteaucitron.js.
The module doesn't sufficiently filter user-supplied markup inside of content leading to a persistent Cross Site Scripting (XSS) vulnerability. More details are available in CVE-2023-3620.
This vulnerability is mitigated by the fact that an attacker needs to be able to write content in the page, a feature commonly available on Drupal sites.
Affected packages
Packagist:https://packages.drupal.org/8
drupal/tacjs
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.0"}],"database_specific":{"constraint":"<6.5.0"}}]
References
- web drupal.org