CVE-2019-16172: Cross-site Scripting in LimeSurvey
Cross-site Scripting in LimeSurvey
Other sources
LimeSurvey before v3.17.14 allows stored XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. The attack uses a survey group in which the title contains JavaScript that is mishandled upon group deletion.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/limesurvey/limesurveyto a version that resolves this vulnerability.Fixed in 3.17.14
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2019-16172.
What is the severity rating of CVE-2019-16172?
The severity rating of CVE-2019-16172 is medium, with a severity value of 5.4.
How does CVE-2019-16172 allow privilege escalation?
CVE-2019-16172 allows privilege escalation by exploiting a stored cross-site scripting (XSS) vulnerability in LimeSurvey before version 3.17.14.
What software versions are affected by CVE-2019-16172?
LimeSurvey versions up to and excluding 3.17.4 are affected by CVE-2019-16172.
How can I remediate the CVE-2019-16172 vulnerability?
To remediate the CVE-2019-16172 vulnerability, it is recommended to update LimeSurvey to version 3.17.14 or later.