Test Kennung:	1.3.6.1.4.1.25623.1.0.131033
Kategorie:	Web application abuses
Titel:	LimeSurvey < 6.5.14 Multiple Vulnerabilities
Zusammenfassung:	LimeSurvey is prone to multiple vulnerabilities.
Beschreibung:	Summary: LimeSurvey is prone to multiple vulnerabilities. Vulnerability Insight: The following vulnerabilities exist: - CVE-2024-42901: LimeSurvey doesn't sanitize the name of the csv file used to import users. This results in a stored-XSS if an attacker with high privileges specifies a malicious payload as the csv file name. - CVE-2024-42902: Kcfinder file manager uses the 'js_localize.php' function to set the user's language by taking the language file name from the 'lng' query string parameter, without properly sanitizing it. This allows an attacker to specify an arbitrary file to include and execute them, resulting in a local file inclusion (LFI). Affected Software/OS: LimeSurvey version 6.5.14 and probably prior. Solution: Update to version 6.5.14 or later. CVSS Score: 9.0 CVSS Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2024-42901 Common Vulnerability Exposure (CVE) ID: CVE-2024-42902
Copyright	Copyright (C) 2024 Greenbone AG

Dies ist nur einer von 146377 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.