Cross site scripting

2012-09-1919:55:00

PRIOn knowledge base

www.prio-n.com

6.2 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

65.5%

JSON

Cross-site scripting (XSS) vulnerability in admin/userrighthandling.php in LimeSurvey before 1.91+ Build 120224 allows remote attackers to inject arbitrary web script or HTML via the full_name parameter in a moduser action to admin/admin.php. NOTE: some of these details are obtained from third party information.

CPENameOperatorVersion
limesurveyeq1.80.0
limesurveyeq1.72
limesurveyeq1.85
limesurveyeq1.53.0
limesurveyeq<= 1.91
limesurveyeq1.52
limesurveyeq1.87.0
limesurveyeq1.86
limesurveyeq1.90.0
limesurveyeq1.81.0

Name	Operator	Version
limesurvey	eq	1.80.0
limesurvey	eq	1.72
limesurvey	eq	1.85
limesurvey	eq	1.53.0
limesurvey	eq	<= 1.91
limesurvey	eq	1.52
limesurvey	eq	1.87.0
limesurvey	eq	1.86
limesurvey	eq	1.90.0
limesurvey	eq	1.81.0

Rows per page:

1-10 of 151

References

freecode.com/projects/limesurvey/releases/342070

osvdb.org/79687

secunia.com/advisories/48184

www.limesurvey.org/en/stable-release

exchange.xforce.ibmcloud.com/vulnerabilities/73563