CVE-2021-42112: XSS
The "File upload question" functionality in LimeSurvey 3.x-LTS through 3.27.18 allows XSS in assets/scripts/modaldialog.js and assets/scripts/uploader.js.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-42112?
CVE-2021-42112 is a vulnerability that allows for XSS (Cross-Site Scripting) attacks in the File upload question functionality of LimeSurvey 3.x-LTS through 3.27.18.
What is the severity rating of CVE-2021-42112?
CVE-2021-42112 has a severity rating of 6.1 (Medium).
How does CVE-2021-42112 impact LimeSurvey?
CVE-2021-42112 allows for XSS attacks in assets/sc...modaldialog.js and assets/scripts/uploader.js files of LimeSurvey, potentially compromising user data and enabling unauthorized access.
Is there a fix available for CVE-2021-42112?
Yes, LimeSurvey has released a fix for CVE-2021-42112. It is recommended to update to version 3.27.19 or newer to mitigate the vulnerability.
Where can I find more information about CVE-2021-42112?
You can find more information about CVE-2021-42112 in the following references: [Link 1](https://bugs.limesurvey.org/view.php?id=17562), [Link 2](https://github.com/LimeSurvey/LimeSurvey/commit/d56619a50cfd191bbffd0adb660638a5e438070d), [Link 3](https://www.on-x.com/sites/default/files/on-x_-_security_advisory_-_limesurvey_-_cve-2021-42112.pdf)