Daniel Schiavone

**Name of the Vulnerable Software and Affected Versions** Tealium iQ Tag Management versions 0.0.0 through 2.4.0 **Description** Improperly controlled modification of dynamically-determined object attributes in the Tealium iQ Tag Management module allows for Object Injection. This occurs because the `tealiumiq` field stores data as PHP-serialized strings; if malicious data is written to this field, it can be executed when the data is unserialized. Exploitation requires the attacker to have permissions to edit a content entity with an attached `tealiumiq` field. Additionally, the core `jsonapi` module must be enabled with the option "Accept all JSON:API create, read, update, and delete operations", or the attacker must have an alternative method to edit field values directly. **Recommendations** Update Tealium iQ Tag Management to a version later than 2.4.0. Restrict permissions to edit content entities containing the `tealiumiq` field. Disable the "Accept all JSON:API create, read, update, and delete operations" option in the `jsonapi` module.