CVE-2020-25797: 
NixOS vulnerability analysis and mitigation

LimeSurvey 3.21.1 was found to be vulnerable to cross-site scripting (XSS) in the Add Participants Function, specifically in the First and Last name parameters. The vulnerability was discovered on December 19, 2019, and was assigned CVE-2020-25797. When a survey participant is being edited by an administrative user, malicious JavaScript code could be executed in the browser (LimeSurvey Bug, NVD).

The vulnerability is classified as a stored cross-site scripting (XSS) issue with a CVSS v3.1 Base Score of 5.4 (Medium) and vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The issue stems from insufficient validation of user input in the participant management interface, where malicious JavaScript code could be injected through the firstname and lastname fields (NVD).

The vulnerability allows attackers with appropriate permissions (non-admin user role) to inject malicious JavaScript code that would be executed when administrative users view or edit participant information. This could lead to potential session hijacking, data theft, or other malicious actions performed in the context of the administrative user's session (LimeSurvey Bug).

The vulnerability requires an attacker to have valid credentials with permissions to add survey participants. The attack can be executed by inserting malicious JavaScript code into the First and Last name fields when creating or editing survey participants. The vulnerability was confirmed to be exploitable in surveys with registration enabled, potentially making it publicly accessible in certain configurations (LimeSurvey Bug).

The vulnerability was fixed in LimeSurvey version 3.21.2 and also included in release 4.0.0+200116. The fix involved implementing proper input validation and output encoding in the participant management interface (LimeSurvey Commit).