Description

LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Add Participants Function (First and last name parameters). When the survey participant being edited, e.g. by an administrative user, the JavaScript code will be executed in the browser.

Remediation

References

CVE-2020-25797

Related Vulnerabilities

WordPress Plugin Elementor Website Builder Cross-Site Scripting (2.9.8)

SugarCRM Missing Authorization Vulnerability (CVE-2020-7472)

EspoCRM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-14547)

Jboss EAP Missing Release of Memory after Effective Lifetime Vulnerability (CVE-2022-0853)

MediaWiki Missing Authentication for Critical Function Vulnerability (CVE-2019-12468)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities CWE-707 CVE-2020-25797