CVE-2022-48010

Description

LimeSurvey v5.4.15 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /index.php/surveyAdministration/rendersidemenulink?subaction=surveytexts. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description or Welcome-message text fields. NOTE: the vendor indicates that this is not a vulnerability because the manipulation requires Superadministrator privileges, and Superadministrators are already allowed to customize surveys with JavaScript as they wish.

How to fix CVE-2022-48010

To remediate CVE-2022-48010, upgrade the affected package to a fixed version below.

• —upgrade to 5.4.16 or later

Is CVE-2022-48010 being exploited?

Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• >= 5.4.15, < 5.4.16

CVSS scores

References (2)

• WEBgithub.com/Sakura-501/LimeSurvey-5.4.15-Stored-XSS-in-surveytexts
• WEBnvd.nist.gov/vuln/detail/CVE-2022-48010