CVE-2022-33155: Cross Site Scripting Vulnerability in ameos_tarteaucitron Package
Summary
CVE-2022-33155: Cross site scripting in ameos_tarteaucitron. Affects ameos/ameos_tarteaucitron versions < 1.2.23. Fixed in 1.2.23. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ameos_tarteaucitron package is a TYPO3 extension designed to manage GDPR cookie banners and tracking in compliance with French RGPD regulations. It provides functionalities for users to manage their cookie preferences and ensures that websites adhere to privacy laws. However, prior to version 1.2.23, this package is susceptible to a cross-site scripting (XSS) vulnerability, which can compromise user security.
Vulnerability Detail
The vulnerability arises from improper handling of user input, allowing attackers to inject malicious scripts into web pages viewed by other users. This XSS flaw can lead to unauthorized actions being performed on behalf of users, data theft, and exposure of sensitive information. The vulnerability is classified under CWE-79, which pertains to improper neutralization of input during web page generation. If exploited, it can severely impact the integrity and confidentiality of user data.
How To Fix
Minimum fixed version
1.2.23
This is the first release that contains the fix.
composer require ameos/ameos_tarteaucitron:1.2.23Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, a temporary workaround is to sanitize user inputs and escape outputs in the affected areas of your application. This can help mitigate the risk of XSS attacks until the package is updated. Implementing Content Security Policy (CSP) headers can also provide an additional layer of security.
Conclusion
The ameos_tarteaucitron package has a critical XSS vulnerability that can compromise user security. It is crucial to update to version 1.2.23 or later to mitigate this risk. Utilizing tools like Vulert can help monitor for such vulnerabilities in your applications.
See every vulnerability recorded for ameos/ameos_tarteaucitron →
FAQ
The vulnerability is a cross-site scripting (XSS) issue that allows attackers to inject malicious scripts into web pages.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized actions, data theft, and exposure of sensitive user information.
Yes, the vulnerability is patched in version 1.2.23 of the ameos_tarteaucitron package. Updating to this version will resolve the issue.
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
