CVE-2020-11456: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: LimeSurvey before 4.1.12+200324 has stored XSS in application/views/admin/surveysgroups/surveySettings.php and application/models/SurveysGroups.php (aka survey groups).
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2020-04-01T16:15Z
Repository: https://github.com/LimeSurvey/LimeSurvey
Language: PHP
Files changed: application/models/SurveysGroups.php, application/views/admin/surveysgroups/surveySettings.php
Commit date: 2020-03-23 18:30:55 +0100
Commit message: Fixed issue [security] #16019: Stored XSS in survey groups. (Thanks to Matthew Aberegg and Michael Burkey)
Dev: admin view to be fixed
Dev: not shown in public : no need XSS filtering

Diff: diff --git a/application/models/SurveysGroups.php b/application/models/SurveysGroups.php
index cc20fe668a4..65c2b2b4964 100644
--- a/application/models/SurveysGroups.php
+++ b/application/models/SurveysGroups.php
@@ -39,11 +39,10 @@ class SurveysGroups extends LSActiveRecord
             array('sortorder, owner_id, parent_id, created_by', 'numerical', 'integerOnly'=>true),
             array('name', 'length', 'max'=>45),
             array('name', 'match', 'pattern'=> '/^[A-Za-z0-9_\.]+$/u','message'=> gT('Group name can contain only alphanumeric character, underscore or dot.')),
             array('title', 'length', 'max'=>100),
             array('description, created, modified', 'safe'),
-            array('title, name, description', 'LSYii_Validators'),
             // The following rule is used by search().
             // @todo Please remove those attributes that should not be searched.
             array('gsid, name, title, description, owner_id, parent_id, created, modified, created_by', 'safe', 'on'=>'search'),
         );
     }
diff --git a/application/views/admin/surveysgroups/surveySettings.php b/application/views/admin/surveysgroups/surveySettings.php
index 2d41c244fd2..024b114198b 100644
--- a/application/views/admin/surveysgroups/surveySettings.php
+++ b/application/views/admin/surveysgroups/surveySettings.php
@@ -29,11 +29,11 @@ Yii::app()->getClientScript()->registerScript(
             'saveandclosebutton' => array(
                 'form' => 'survey-settings-options-form'
                 )
                 )
             )); ?>
-    <h3><?php eT('Survey settings for group: '); echo '<strong><em>'.$model->title.'</strong></em>'; ?></h3>
+    <h3><?php eT('Survey settings for group: '); echo '<strong><em>'.CHtml::encode($model->title).'</strong></em>'; ?></h3>
     <div class="row">
         <div id="surveySettingsForThisGroup" style="display: flex; flex-wrap:nowrap;">
             <div id="global-sidebar-container">
                 <global-sidemenu />
             </div>

Vulnerable code:             array('title, name, description', 'LSYii_Validators'),
    <h3><?php eT('Survey settings for group: '); echo '<strong><em>'.$model->title.'</strong></em>'; ?></h3>
Fixed code:     <h3><?php eT('Survey settings for group: '); echo '<strong><em>'.CHtml::encode($model->title).'</strong></em>'; ?></h3>