Threats tagged 'ghsa-jggg-h3r2-j73w'

SurveyKing versions 1.12.0 through 1.13.2 have an authentication bypass vulnerability that allows unauthenticated attackers to submit survey responses. The flaw exists because the AnswerServiceImpl.saveAnswer function skips login and survey password checks. Attackers can submit responses to protected surveys and impersonate other users by setting the createBy field in the request body, potentially corrupting survey results.