Executive Summary

This vulnerability is a cross-site scripting (XSS) issue in Taguette versions prior to 1.5.0. It occurs because the application does not properly sanitize user input in fields like tag name, tag description, document name, and document description. As a result, a project member can inject JavaScript code that executes when the project is loaded, potentially affecting other users. [2]

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows a project member to inject malicious JavaScript code that runs when other users load the project. This can lead to limited data exposure and modification, potentially compromising user data or session information. However, it does not affect system availability or cause denial of service. [2]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if your Taguette installation is running a version prior to 1.5.0, as those versions are vulnerable. Additionally, you can inspect project data fields such as tag name, tag description, document name, and document description for injected JavaScript code. Since the vulnerability involves stored cross-site scripting (XSS), manual or automated scanning of these fields for suspicious script tags or JavaScript code can help detect exploitation. Specific commands are not provided in the resources, but you can query your database or export project data and search for patterns like '<script>' or 'javascript:' in these fields. [2, 1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade Taguette to version 1.5.0 or later, where the issue has been fixed. This upgrade ensures proper neutralization of user input in the affected fields, preventing JavaScript injection. Additionally, review and sanitize existing project data fields to remove any malicious scripts that may have been injected prior to the upgrade. [2]

Useful 0 Not Useful 0