CyberRota Analysis
AI-GeneratedThe tarteaucitron.js cookie banner prior to version 1.33.0 is vulnerable to an arbitrary cookie deletion attack, where an attacker can exploit the purgeBtn class to remove non-HttpOnly cookies without proper validation. This could lead to unauthorized access or manipulation of user sessions and data. Organizations using affected versions of tarteaucitron.js should prioritize upgrading to version 1.33.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.33.0, tarteaucitron.cookie.purge() is called on any element with the purgeBtn class and does not check whether the element is a legitimate tarteaucitron button or whether the cookie corresponds to a service handled by tarteaucitron. If an attacker can write HTML with data attributes, an element with data-cookie can silently delete a non-HttpOnly cookie with a known name when clicked by a user. This issue is fixed in version 1.33.0.