MEDIUM6.1

GHSA-632q-77qj-c89q

LimeSurvey Cross Site Scripting vulnerability

Quick fix

GHSA-632q-77qj-c89q — limesurvey/limesurvey: upgrade to the fixed version with the command below.

composer require limesurvey/limesurvey:^6.5.0

Details

Cross Site Scripting vulnerability in LimeSurvey before 6.5.0+240319 allows a remote attacker to execute arbitrary code via a lack of input validation and output encoding in the Alert Widget's message component.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/limesurvey/limesurvey

Introduced in: 0Fixed in: 6.5.0

Fixcomposer require limesurvey/limesurvey:^6.5.0

References

https://nvd.nist.gov/vuln/detail/CVE-2024-28710[ADVISORY]
https://github.com/LimeSurvey/LimeSurvey/commit/c2fd60f94bc1db275f20cbb27a3135a9bdfb7f10[WEB]
https://github.com/LimeSurvey/LimeSurvey[PACKAGE]
https://www.limesurvey.org[WEB]
http://limesurvey.com[WEB]