Cross-site scripting in Survey Creator

Description

Cross Site Scripting (XSS) vulnerability in SurveyJS Survey Creator v.1.9.132 and before, allows attackers to execute arbitrary code and obtain sensitive information via the title parameter in form.

Recommendation

Update the survey-creator package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.9.133
• Patched version(s): 1.9.133

References

• GHSA-xgj4-2hrf-j4xg
• packetstormsecurity.com
• CVE-2024-28635
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• DOM clobbering could escalate to Cross-site Scripting (XSS) - CVE-2024-45389
• DOM clobbering could escalate to Cross-site Scripting (XSS) - pagefind - CVE-2024-45389
• DOM clobbering could escalate to Cross-site Scripting (XSS) - @pagefind/default-ui - CVE-2024-45389
• VvvebJs Reflected Cross-Site Scripting (XSS) vulnerability - CVE-2024-29271

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

survey-creator