CVE-2018-20322

Опубликовано: 21 дек. 2018

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

LimeSurvey version 3.15.5 contains a Cross-site scripting (XSS) vulnerability in Survey Resource zip upload, resulting in Javascript code execution against LimeSurvey administrators. Fixed in version 3.15.6.

Ссылки

https://bugs.limesurvey.org/view.php?id=14376
Issue Tracking
Permissions Required
Vendor Advisory
https://github.com/LimeSurvey/LimeSurvey/commit/bfee69edaa0b90f97dc2d8fab09a87958cb32405
Patch
Third Party Advisory
https://bugs.limesurvey.org/view.php?id=14376
Issue Tracking
Permissions Required
Vendor Advisory
https://github.com/LimeSurvey/LimeSurvey/commit/bfee69edaa0b90f97dc2d8fab09a87958cb32405
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:limesurvey:limesurvey:*:*:*:*:*:*:*:*

Версия до 3.15.5 (включая)

EPSS

Процентиль: 61%

0.00408

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

CVE-2018-20322

CVSS3: 6.1

debian

около 7 лет назад

LimeSurvey version 3.15.5 contains a Cross-site scripting (XSS) vulner ...

GHSA-w7rh-m853-j7w3

CVSS3: 6.1

github

больше 3 лет назад

EPSS

Процентиль: 61%

0.00408

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79