CVE-2019-17660

2019-10-1616:15:11

Google

osv.dev

5.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.4%

JSON

A cross-site scripting (XSS) vulnerability in admin/translate/translateheader_view.php in LimeSurvey 3.19.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the tolang parameter, as demonstrated by the index.php/admin/translate/sa/index/surveyid/336819/lang/ PATH_INFO.

CPENameOperatorVersion
limesurveyeq2.05_plus_140915
limesurveyeq3.6.1+180329
limesurveyeq2.00_plus_121106
limesurveyeq1.70_plus_2008-03-09
limesurveyeq3.13.2+180709
limesurveyeq1.70_plus_2008-05-21
limesurveyeq1.92_plus_120418
limesurveyeq3.16.1+190225
limesurveyeq2.00RC5_120719
limesurveyeq2.00_plus_121211

Name	Operator	Version
limesurvey	eq	2.05_plus_140915
limesurvey	eq	3.6.1+180329
limesurvey	eq	2.00_plus_121106
limesurvey	eq	1.70_plus_2008-03-09
limesurvey	eq	3.13.2+180709
limesurvey	eq	1.70_plus_2008-05-21
limesurvey	eq	1.92_plus_120418
limesurvey	eq	3.16.1+190225
limesurvey	eq	2.00RC5_120719
limesurvey	eq	2.00_plus_121211