4.3

CVE-2018-1000514

Exploit
LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery (CSRF) vulnerability in Boxes that can result in CSRF admins to delete boxes. This vulnerability appears to have been fixed in 3.6.x.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Limesurvey ≫ Limesurvey Version3.0.0 Updatebeta.3+17110
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.34% 0.256
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 2.8 1.4
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

https://bugs.limesurvey.org/plugin.php?page=Source/view&id=26925
Patch
Vendor Advisory
Issue Tracking
https://bugs.limesurvey.org/view.php?id=13562
Vendor Advisory
Exploit
Issue Tracking