Description
tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside a benign url to execute script in the site's origin via iframe src.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
AmauriC tarteaucitron.js
Default version status: unaffected
1.20.1 to < 1.37.0affected
pkg:github/AmauriC/tarteaucitron.jsReferences
- https://github.com/AmauriC/tarteaucitron.js/commit/068653bd47f5d4a493251ca8e15bd2b0be9b544f ↗
- https://github.com/AmauriC/tarteaucitron.js/releases/tag/v1.37.0 ↗
- https://github.com/AmauriC/tarteaucitron.js/blob/v1.36.0/tarteaucitron.js#L2641-L2648 ↗
- https://github.com/AmauriC/tarteaucitron.js/compare/v1.36.0...v1.37.0 ↗
- https://www.vulncheck.com/advisories/tarteaucitron-js-before-1.37.0-xss-via-getelemattr-attribute-validation-mismatch ↗