Lucene search

GoogleOSV:CVE-2018-17003

HistorySep 21, 2018 - 5:29 p.m.

CVE-2018-17003

2018-09-2117:29:06

Google

osv.dev

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.2 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

30.5%

JSON

In LimeSurvey 3.14.7, HTML Injection and Stored XSS have been discovered in the appendix via the surveyls_title parameter to /index.php?r=admin/survey/sa/insert.

CPENameOperatorVersion
limesurveyeq2.05_plus_141126
limesurveyeq2.51.4_160908
limesurveyeq1.92_plus_120704
limesurveyeq1.91_plus_2011-08-05
limesurveyeq1.86_2009-09-30
limesurveyeq2.00_plus_121120
limesurveyeq2.50_plus_160213
limesurveyeq2.50_plus_160503
limesurveyeq1.92_plus_120330
limesurveyeq2.50RC7_160121

Name	Operator	Version
limesurvey	eq	2.05_plus_141126
limesurvey	eq	2.51.4_160908
limesurvey	eq	1.92_plus_120704
limesurvey	eq	1.91_plus_2011-08-05
limesurvey	eq	1.86_2009-09-30
limesurvey	eq	2.00_plus_121120
limesurvey	eq	2.50_plus_160213
limesurvey	eq	2.50_plus_160503
limesurvey	eq	1.92_plus_120330
limesurvey	eq	2.50RC7_160121

Rows per page:

1-10 of 5421

References

packetstormsecurity.com/files/149435/LimeSurvey-3.14.7-Cross-Site-Scripting.html

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.2 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

30.5%

JSON

Related for OSV:CVE-2018-17003