CVE-2018-1000658
High
Description
LimeSurvey version prior to 3.14.4 contains a file upload vulnerability in upload functionality that can result in an attacker gaining code execution via webshell. This attack appear to be exploitable via an authenticated user uploading a zip archive which can contains malicious php files that can be called under certain circumstances. This vulnerability appears to have been fixed in after commit 91d143230eb357260a19c8424b3005deb49a47f7 / version 3.14.4.
SeverityHigh
CVSS8.8
Exploit probability82. percentile2.1%
ProductLimesurvey
PublishedSep 6, 2018
First seenSep 6, 2018
How to fix
Update
- limesurvey limesurvey3.14.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| limesurvey limesurvey | v < 3.14.4 | 3.14.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.