MEDIUM6.1

GHSA-h9ph-jcgh-gf69

Cross-site Scripting in Limesurvey

Quick fix

GHSA-h9ph-jcgh-gf69 — limesurvey/limesurvey: upgrade to the fixed version with the command below.

composer require limesurvey/limesurvey:^3.27.19

Details

The "File upload question" functionality in LimeSurvey 3.x-LTS through 3.27.18 allows XSS in assets/scripts/modaldialog.js and assets/scripts/uploader.js.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/limesurvey/limesurvey

Introduced in: 0Fixed in: 3.27.19

Fixcomposer require limesurvey/limesurvey:^3.27.19

References

https://nvd.nist.gov/vuln/detail/CVE-2021-42112[ADVISORY]
https://github.com/LimeSurvey/LimeSurvey/pull/2044[WEB]
https://github.com/LimeSurvey/LimeSurvey/commit/d56619a50cfd191bbffd0adb660638a5e438070d[WEB]
https://bugs.limesurvey.org/view.php?id=17562[WEB]
https://github.com/LimeSurvey/LimeSurvey[PACKAGE]
https://www.on-x.com/sites/default/files/on-x_-_security_advisory_-_limesurvey_-_cve-2021-42112.pdf[WEB]