Back to CVE Browser

CVE-2019-16184

CRITICAL

9.8

CVSS Severity Score

EPSS Score0.1160%

EPSS Percentile15.02th

PublishedSep 9, 2019

Last ModifiedNov 21, 2024

Vulnerability Description

A CSV injection vulnerability was found in Limesurvey before 3.17.14 that allows survey participants to inject commands via their survey responses that will be included in the export CSV file.

Affected Platforms (CPE)

📦

Limesurvey

Limesurvey

< 3.17.14

References & Advisories

🔗 https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R46

🔗 https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released

🔗 https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R46

🔗 https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released

Related Vulnerabilities

CVE-2020-114559.8

LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php...

CVE-2019-99609.8

The downloadZip function in application/controllers/admin/export.php in LimeSurvey through 3.16.1+190225 allows a relative path.

CVE-2019-250199.8

LimeSurvey before 4.0.0-RC4 allows SQL injection via the participant model.

CVE-2008-25709.3

Multiple unspecified vulnerabilities in LimeSurvey (formerly PHPSurveyor) before 1.71 have unknown impact and attack vectors.