CVE-2020-11456: LimeSurvey survey groups stored XSS in admin views

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

medium priorityCVSS rates it medium (5.4) and it requires authentication plus victim interaction, but public exploit code and a very high EPSS score raise the practical risk.

What it is

LimeSurvey before 4.1.12+200324 contains a stored cross-site scripting flaw in the survey groups admin code (application/views/admin/surveysgroups/surveySettings.php and application/models/SurveysGroups.php). Because the payload is stored, it persists and executes in the browser of any user who views the affected survey group settings. The record does not specify which input field is vulnerable or the exact rendering context.

Impact

An attacker with a low-privileged account can inject script that runs in another user's session, enabling session theft, credential capture or actions performed as the victim in the LimeSurvey admin interface. The CVSS scope change (S:C) indicates the impact can extend beyond the vulnerable component.

Attack surface

Reached over the network through the LimeSurvey web interface; the vector requires low privileges (PR:L) and user interaction (UI:R), meaning an authenticated low-privileged user must store the payload and a victim must view the affected survey group settings page. No unauthenticated path is described.

Exploitation

Public exploit code exists (Packet Storm and Exploit-DB references tagged Exploit) and EPSS is high at 0.70841 (99.4th percentile), but the CVE is not listed in CISA KEV, so no confirmed in-the-wild exploitation is documented in this record.

What to do

• Upgrade LimeSurvey to 4.1.12+200324 or later; the patch commit is 04b118acce2a74306f365ef329cbe00efc399b26.
• If immediate upgrade is not possible, restrict access to the survey groups admin functionality to trusted administrators only.
• Apply output encoding and input sanitisation to survey group settings fields, and enforce a Content Security Policy that blocks inline script.
• Review accounts with survey group creation or editing rights and remove unnecessary privileges.
• Monitor vendor advisories for any follow-up fixes to the same code paths.

Detection

• Search web and application logs for script tags or event handler attributes in requests to survey group settings endpoints.
• Review stored survey group configuration values in the database for HTML or JavaScript content.
• Alert on anomalous admin sessions or actions following a survey group settings page view.
• Correlate access to application/views/admin/surveysgroups/surveySettings.php with unusual client behaviour or outbound requests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.