CVE-2024-28710
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
Cross Site Scripting (XSS) vulnerability in LimeSurvey before version 6.5.0+240319 allows a remote attacker to execute arbitrary JavaScript code in the victim's browser. The issue stems from missing input validation and output encoding in the Alert Widget's message component.
Risk Assessment
An attacker can inject a malicious script, leading to session theft, admin account takeover, or website defacement. The risk is especially high in production environments with multiple users.
Recommendation
Immediately upgrade LimeSurvey to version 6.5.0+240319 or later. If upgrading is not possible, temporarily disable the Alert Widget or apply WAF rules to block suspicious parameters.
Original NVD description (English source)
Cross Site Scripting vulnerability in LimeSurvey before 6.5.0+240319 allows a remote attacker to execute arbitrary code via a lack of input validation and output encoding in the Alert Widget's message component.