What is GHSA-h9ph-jcgh-gf69?

GHSA-h9ph-jcgh-gf69 is a security advisory published by GitHub Security Advisories with Medium severity. Cross-site Scripting in Limesurvey

Which CVE IDs does GHSA-h9ph-jcgh-gf69 cover?

GHSA-h9ph-jcgh-gf69 covers the following CVE IDs: CVE-2021-42112. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-h9ph-jcgh-gf69?

GHSA-h9ph-jcgh-gf69 has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-h9ph-jcgh-gf69?

GHSA-h9ph-jcgh-gf69 affects 1 product, including: composer/limesurvey/limesurvey:\u003c 3.27.19.

GHSA-h9ph-jcgh-gf69MediumCVSS 6.1

Cross-site Scripting in Limesurvey

Vendor

GitHub Security Advisories

Published

October 12, 2021

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2021-42112 →

📋 Description

The "File upload question" functionality in LimeSurvey 3.x-LTS through 3.27.18 allows XSS in assets/scripts/modaldialog.js and assets/scripts/uploader.js.

🎯 Affected products1

composer/limesurvey/limesurvey:< 3.27.19

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2021-42112
https://github.com/LimeSurvey/LimeSurvey/pull/2044
https://github.com/LimeSurvey/LimeSurvey/commit/d56619a50cfd191bbffd0adb660638a5e438070d
https://bugs.limesurvey.org/view.php?id=17562
https://www.on-x.com/sites/default/files/on-x_-_security_advisory_-_limesurvey_-_cve-2021-42112.pdf
https://github.com/advisories/GHSA-h9ph-jcgh-gf69