TacJS - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-016

2024-03-2700:00:00

Drupal Security Team

www.drupal.org

european cookie law

tarteaucitron.js

cross site scripting

xss

cve-2023-3620

vulnerability

drupal sites

security

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

5.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.5%

JSON

This module enables sites to comply with the European cookie law using tarteaucitron.js. The module doesn’t sufficiently filter user-supplied markup inside of content leading to a persistent Cross Site Scripting (XSS) vulnerability. More details are available in CVE-2023-3620. This vulnerability is mitigated by the fact that an attacker needs to be able to write content in the page, a feature commonly available on Drupal sites.