CVE-2024-28710

Summary

CVE-2024-28710 is a Cross-Site Scripting (XSS) vulnerability affecting LimeSurvey versions before 6.5.0+240319. The issue stems from insufficient input validation and output encoding in the Alert Widget's message component. An attacker can exploit this weakness to inject and execute malicious scripts in a user's browser, posing a significant risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access, session hijacking, or data theft. Users are strongly advised to upgrade to a patched version of LimeSurvey to mitigate this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.