Cross-Site Request Forgery Vulnerability in LimeSurvey by LimeSurvey
CVE-2018-1000053

8.8HIGH

Key Information:

Vendor

Limesurvey

Status
Limesurvey
Vendor
CVE Published:
9 February 2018

What is CVE-2018-1000053?

An identified vulnerability in LimeSurvey version 3.0.0-beta.3+17110 involves a Cross-Site Request Forgery (CSRF) issue within the Theme Uninstallation feature. This exploit allows unauthorized individuals to send a crafted GET request, potentially resulting in the deletion of all themes managed by a LimeSurvey administrator. Such actions can lead to a complete unavailability of the website, affecting its operations and user access. Efforts to secure this vulnerability must be prioritized to maintain website functionality and administrator control.

References

https://github.com/LimeSurvey/LimeSurvey/commit/1e440208a...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.