CVE-2024-28709: LimeSurvey Cross Site Scripting Vulnerability
Summary
CVE-2024-28709: LimeSurvey Cross Site Scripting vulnerability. Affects limesurvey/limesurvey versions < 6.5.12. Fixed in 6.5.12. How to fix ↓
Also tracked for
- limesurvey · Bitnami
The same CVE-2024-28709 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LimeSurvey is an open-source online survey application that allows users to create, manage, and analyze surveys. It is widely used for academic research, market research, and feedback collection due to its user-friendly interface and extensive features. However, like many web applications, it is susceptible to security vulnerabilities, including Cross Site Scripting (XSS), which can compromise the integrity and confidentiality of user data.
Vulnerability Detail
The vulnerability identified as CVE-2024-28709 is a Cross Site Scripting (XSS) flaw present in LimeSurvey versions prior to 6.5.12+240611. This vulnerability allows remote attackers to inject malicious scripts into the title and comment fields of surveys. When unsuspecting users interact with these fields, the crafted scripts can execute in their browsers, potentially leading to unauthorized actions, data theft, or session hijacking. The vulnerability is classified under CWE-79, indicating its nature as an XSS issue, which is a common attack vector in web applications.
How To Fix
Minimum fixed version
6.5.12
This is the first release that contains the fix.
composer require limesurvey/limesurvey:6.5.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, a temporary workaround is to sanitize user inputs in the title and comment fields to prevent script execution. This can be done by implementing input validation and encoding outputs to ensure that any HTML or JavaScript code is rendered harmless.
Conclusion
The CVE-2024-28709 vulnerability in LimeSurvey poses a significant risk due to its potential for Cross Site Scripting attacks. Users are strongly advised to update to the latest version to protect their applications. Additionally, understanding the nature of XSS and implementing best practices for input handling can further enhance security.
See every vulnerability recorded for limesurvey/limesurvey →
FAQ
Cross Site Scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially compromising their data and sessions.
If you are using a version of LimeSurvey prior to 6.5.12, your installation is vulnerable. You can check your version in the admin dashboard or by reviewing the composer.lock file.
The risks include unauthorized access to user accounts, data theft, and the potential for attackers to perform actions on behalf of users without their consent.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just the composer.lock file. You can check your application against known vulnerabilities without needing to install any software.
If you cannot update immediately, implement input validation and output encoding as a temporary measure to mitigate the risk of XSS attacks.
Related vulnerabilities
Recent vulnerabilities recorded for limesurvey/limesurvey.
