PT-2019-14558 · Limesurvey · Limesurvey

J. Greil · Published 2019-09-09 · Updated 2019-09-10 · CVE-2019-16178

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Limesurvey versions prior to 3.17.14

Description A stored cross-site scripting issue was discovered that allows authenticated users with the correct permissions to inject arbitrary web script or HTML via titles of admin box buttons on the home page.

Recommendations For versions prior to 3.17.14, update to version 3.17.14 or later to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-16178

Affected Products

Limesurvey

References · 4

• https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R39 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-16178 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16178 · Vendor Advisory
• https://limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released · Note