| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| tarteaucitronjs | < 1.33.0 | 1.33.0 |
tarteaucitron provides a list of cookies and buttons to delete them. If an attacker can write HTML with data attributes, they could create an element that silently deletes a cookie when clicked and trick a user to delete this cookie.
tarteaucitron.cookie.purge() is called on any element with the purgeBtn class. It does not check if the element is a legitimate tarteaucitron button or if the cookie corresponds to a service handled by tarteaucitron.
<a class="purgeBtn" data-cookie="foo">Click me!</a>
If someone has a cookie with this name and clicks on the link, the cookie is silently deleted.
The impact is limited because this only works on cookies without HttpOnly=true and the attacker has to know the name of the cookie.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí