Lucene search

GoogleOSV:CVE-2022-48008

HistoryJan 27, 2023 - 6:15 p.m.

CVE-2022-48008

2023-01-2718:15:15

Google

osv.dev

arbitrary file upload

limesurvey v5.4.15

arbitrary code execution

plugin manager

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

70.0%

JSON

An arbitrary file upload vulnerability in the plugin manager of LimeSurvey v5.4.15 allows attackers to execute arbitrary code via a crafted PHP file.

CPENameOperatorVersion
limesurveyeq3.14.7+180827
limesurveyeq3.17.9+190731
limesurveyeq2.00_plus_131202
limesurveyeq2.05_plus_140611
limesurveyeq2.50_plus_160620
limesurveyeq4.0.0-beta
limesurveyeq2.50RC8_160131
limesurveyeq4.6.3+210518
limesurveyeq2.06_plus_150731
limesurveyeq2.50_plus_160215

Name	Operator	Version
limesurvey	eq	3.14.7+180827
limesurvey	eq	3.17.9+190731
limesurvey	eq	2.00_plus_131202
limesurvey	eq	2.05_plus_140611
limesurvey	eq	2.50_plus_160620
limesurvey	eq	4.0.0-beta
limesurvey	eq	2.50RC8_160131
limesurvey	eq	4.6.3+210518
limesurvey	eq	2.06_plus_150731
limesurvey	eq	2.50_plus_160215

Rows per page:

1-10 of 8021

References

github.com/Sakura-501/LimeSurvey-5.4.15-PluginUploadtoRCE

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

70.0%

JSON

Related for OSV:CVE-2022-48008