PT-2018-18153

CVE-2018-7556

·

Publicado

2018-02-28

·

Atualizado

2018-03-23

Descrição por

CVSS 3.1
9.1
Crítica
MétricasAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions LimeSurvey versions 2.6.x through 2.6.6 LimeSurvey versions 2.7x.x through 2.73.0 LimeSurvey versions 3.x through 3.4.1
Description The issue arises from the mishandling of the application/controller/InstallerController.php file after installation. This mishandling allows remote attackers to access the configuration file.
Recommendations For LimeSurvey versions 2.6.x through 2.6.6, update to version 2.6.7 or later. For LimeSurvey versions 2.7x.x through 2.73.0, update to version 2.73.1 or later. For LimeSurvey versions 3.x through 3.4.1, update to version 3.4.2 or later.
Explorabilidade
Correção
Impactos
Fornecedores
Produtos afetados
Enumeração de fraquezas
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Identificadores relacionados
CVE-2018-7556
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com