Tealium Iq Tag Management
Improperly controlled modification of dynamically-determined object attributes in the Tealium iQ Tag Management module allows for Object Injection. This occurs because the `tealiumiq` field stores data as PHP-serialized strings; if malicious data is written to this field, it can be executed when the data is unserialized. Exploitation requires the attacker to have permissions to edit a content entity with an attached `tealiumiq` field. Additionally, the core `jsonapi` module must be enabled with the option "Accept all JSON:API create, read, update, and delete operations", or the attacker must have an alternative method to edit field values directly.