CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devsoftbaltic SurveyJS surveyjs allows Stored XSS.This issue affects SurveyJS: from n/a through <= 1.12.20.
Explanation of Vulnerability in Simple Terms
SurveyJS versions up to 1.12.20 contain a cross-site scripting (XSS) vulnerability that allows an authenticated user to inject malicious scripts. The vulnerability requires user interaction—typically the victim must visit a crafted page or click a link. When exploited, the attacker can steal session data, modify page content, or perform actions on behalf of the victim. The impact extends beyond the vulnerable component due to scope change.
What an attacker can do
Inject malicious scripts that execute in other users' browsers and steal their session data or modify page content.
Potential impact on your site
Users' sessions and data can be compromised if they interact with attacker-controlled content within SurveyJS.
Conditions required to exploit
Attacker must be authenticated with low privileges and the victim must visit a crafted page or click a malicious link.
Key dates
External resources
Related vulnerabilities
