CVE-2019-16173: Cross-site Scripting in LimeSurvey
Cross-site Scripting in LimeSurvey
Other sources
LimeSurvey before v3.17.14 allows reflected XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. This occurs in application/core/SurveyCommonAction.php,
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/limesurvey/limesurveyto a version that resolves this vulnerability.Fixed in 3.17.14
Event History
Frequently Asked Questions
What is CVE-2019-16173?
CVE-2019-16173 is a vulnerability in LimeSurvey before v3.17.14 that allows for reflected XSS attacks, enabling privilege escalation from a low-privileged account to a SuperAdmin account.
How severe is CVE-2019-16173?
The severity of CVE-2019-16173 is rated as medium with a CVSS score of 5.4.
What is the affected software version for CVE-2019-16173?
The affected software version for CVE-2019-16173 is LimeSurvey up to version 3.17.4.
How can an attacker exploit CVE-2019-16173?
An attacker can exploit CVE-2019-16173 by tricking a user into clicking on a specially crafted link or visiting a website that contains malicious code, which then executes in the user's browser and allows the attacker to perform actions on behalf of the user.
Is there a fix available for CVE-2019-16173?
Yes, the fix for CVE-2019-16173 is to upgrade LimeSurvey to version 3.17.14 or later.