—
DRUPAL-CONTRIB-2024-016
Details
This module enables sites to comply with the European cookie law using tarteaucitron.js.
The module doesn't sufficiently filter user-supplied markup inside of content leading to a persistent Cross Site Scripting (XSS) vulnerability. More details are available in [CVE-2023-3620](https://nvd.nist.gov/vuln/detail/CVE-2023-3620).
This vulnerability is mitigated by the fact that an attacker needs to be able to write content in the page, a feature commonly available on Drupal sites.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist:https://packages.drupal.org/8/drupal/tacjs
Introduced in:
0Fixed in: 6.5.0Upgrade drupal/tacjs to 6.5.0 or newer (ecosystem packagist:https://packages.drupal.org/8).