CVE-2019-16187: CSRF
Limesurvey before 3.17.14 uses an anti-CSRF cookie without the HttpOnly flag, which allows attackers to access a cookie value via a client-side script.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-16187?
CVE-2019-16187 is a vulnerability in Limesurvey before version 3.17.14 that allows attackers to access a cookie value via a client-side script due to the anti-CSRF cookie being missing the HttpOnly flag.
How does CVE-2019-16187 impact Limesurvey?
CVE-2019-16187 can be exploited by attackers to access a cookie value through a client-side script, potentially leading to information disclosure or session hijacking.
What is the severity of CVE-2019-16187?
CVE-2019-16187 has a severity rating of high with a CVSS score of 7.5.
How can I fix the CVE-2019-16187 vulnerability in Limesurvey?
To fix the CVE-2019-16187 vulnerability in Limesurvey, you should update to version 3.17.14 or newer, which includes the HttpOnly flag in the anti-CSRF cookie.
Where can I find more information about CVE-2019-16187 and the patch for Limesurvey?
You can find more information about CVE-2019-16187 and the patch for Limesurvey at the following references: [Github Commit](https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R48) and [Limesurvey Updates](https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released).