PT-2020-16218 · Limesurvey · Limesurvey

Guram Javakhishvili · Published 2020-11-17 · Updated 2024-03-06 · CVE-2020-25798

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions LimeSurvey versions prior to 3.21.1

Description A stored cross-site scripting (XSS) issue allows authenticated users with correct permissions to inject arbitrary web script or HTML via the ParticipantAttributeNamesDropdown parameter of the Attributes on the central participant database page. When a survey attribute is being edited or viewed, the JavaScript code will be executed in the browser.

Recommendations For versions prior to 3.21.1, update to a version newer than 3.21.1 to resolve the issue. As a temporary workaround, consider restricting access to the ParticipantAttributeNamesDropdown parameter to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-LIMESURVEY-2020-25798

CVE-2020-25798

Affected Products

Limesurvey

References · 7

• 🔥 https://bugs.limesurvey.org/view.php?id=15672 · Exploit
• https://github.com/LimeSurvey/LimeSurvey/commit/38e1ab069b538de7cb5f3a04939aba8e835640cb · Patch
• https://osv.dev/vulnerability/BIT-limesurvey-2020-25798 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-25798 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25798 · Security Note
• https://t.me/cibsecurity/16448 · Telegram Post
• https://t.me/cvenotify/6255 · Telegram Post