CVE-2018-7556 LimeSurvey 2.6.x before 2.6.7, 2.7x.x before 2.73.1, and 3.x before 3.4.2 mishandles application/controller/InstallerController.php after installation, which allows remote attackers to access the conf...
CriticalCVSS 9.1
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
LimeSurvey 2.6.x before 2.6.7, 2.7x.x before 2.73.1, and 3.x before 3.4.2 mishandles application/controller/InstallerController.php after installation, which allows remote attackers to access the configuration file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| limesurvey/limesurvey | >= 2.6.0, < 2.6.7 | 2.6.7 |
| limesurvey/limesurvey | >= 2.7.0, < 2.73.1 | 2.73.1 |
| limesurvey/limesurvey | >= 3.0.0, < 3.4.2 | 3.4.2 |
| debian linux | = 7.0 | No fix listed |
References
- www.limesurvey.org vendor-advisory