Lucene search

[email protected]CVE-2024-27996

HistoryMar 19, 2024 - 5:15 p.m.

CVE-2024-27996

2024-03-1917:15:10

CWE-79

[email protected]

web.nvd.nist.gov

cve-2024-27996

survey maker

stored xss

nvd

vulnerability

web page generation

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

9.1 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Survey Maker team Survey Maker allows Stored XSS.This issue affects Survey Maker: from n/a through 4.0.5.

Affected configurations

Vulners

Node

survey_maker_teamsurvey_makerRange≤4.0.5

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "survey-maker",
    "product": "Survey Maker",
    "vendor": "Survey Maker team",
    "versions": [
      {
        "changes": [
          {
            "at": "4.0.6",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "4.0.5",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/survey-maker/wordpress-survey-maker-plugin-4-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve