PT-2018-18153

CVE-2018-7556

·

Published

2018-02-28

·

Updated

2018-03-23

Description by

CVSS 3.1
9.1
Critical
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions LimeSurvey versions 2.6.x through 2.6.6 LimeSurvey versions 2.7x.x through 2.73.0 LimeSurvey versions 3.x through 3.4.1
Description The issue arises from the mishandling of the application/controller/InstallerController.php file after installation. This mishandling allows remote attackers to access the configuration file.
Recommendations For LimeSurvey versions 2.6.x through 2.6.6, update to version 2.6.7 or later. For LimeSurvey versions 2.7x.x through 2.73.0, update to version 2.73.1 or later. For LimeSurvey versions 3.x through 3.4.1, update to version 3.4.2 or later.
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Related identifiers
CVE-2018-7556
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com