Description

LimeSurvey v5.4.15 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /index.php/surveyAdministration/rendersidemenulink?subaction=surveytexts. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description or Welcome-message text fields.

Remediation

References

CVE-2022-48010

Related Vulnerabilities

WordPress Plugin All-In-One Security (AIOS)-Security and Firewall Cross-Site Request Forgery (5.1.0)

WordPress Plugin wpForo Forum Open Redirect (1.9.6)

Atlassian Jira Incorrect Default Permissions Vulnerability (CVE-2019-14995)

WordPress Plugin Events Calendar 'ec_management.class.php' Cross-Site Scripting (6.7.11)

WordPress Plugin Catch Import Export Security Bypass (1.8)

Severity

Medium

Classification

CVE-2022-48010 CWE-707 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities