CVE-2024-39063: CSRF
Lime Survey <= 6.5.12 is vulnerable to Cross Site Request Forgery (CSRF). The YIICSRFTOKEN is only checked when passed in the body of POST requests, but the same check isn't performed in the equivalent GET requests.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-39063?
CVE-2024-39063 has been rated as a Medium severity vulnerability due to its exploitation potential.
How do I fix CVE-2024-39063?
To fix CVE-2024-39063, update Lime Survey to version 6.5.13 or later where the CSRF token checks have been properly implemented.
What types of attacks can exploit CVE-2024-39063?
CVE-2024-39063 can be exploited through Cross Site Request Forgery (CSRF) attacks, allowing unauthorized actions to be executed.
Which versions of Lime Survey are affected by CVE-2024-39063?
CVE-2024-39063 affects all versions of Lime Survey up to and including 6.5.12.
Is there a workaround for CVE-2024-39063?
A potential workaround for CVE-2024-39063 is to implement additional validation for GET requests until the software can be updated.