CVEブラウザに戻る

CVE-2019-16184

CRITICAL

9.8

CVSS Severity Score

EPSS Score0.1160%

EPSS Percentile15.02th

Published2019年9月9日

Last Modified2024年11月21日

Vulnerability Description

A CSV injection vulnerability was found in Limesurvey before 3.17.14 that allows survey participants to inject commands via their survey responses that will be included in the export CSV file.

Affected Platforms (CPE)

📦

Limesurvey

Limesurvey

< 3.17.14

References & Advisories

🔗 https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R46

🔗 https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released

🔗 https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R46

🔗 https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released

関連する脆弱性情報

CVE-2020-114559.8

LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php...

CVE-2019-99609.8

The downloadZip function in application/controllers/admin/export.php in LimeSurvey through 3.16.1+190225 allows a relative path.

CVE-2019-250199.8

LimeSurvey before 4.0.0-RC4 allows SQL injection via the participant model.

CVE-2008-25709.3

Multiple unspecified vulnerabilities in LimeSurvey (formerly PHPSurveyor) before 1.71 have unknown impact and attack vectors.