LimeSurvey Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2019-16173 - Vulnerability Database

LimeSurvey

LimeSurvey Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2019-16173

Medium

Reference: CVE-2019-16173

NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2019-16173

Title: LimeSurvey Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability

Overview:

LimeSurvey before v3.17.14 allows reflected XSS for escalating privileges from a low-privileged account to for example SuperAdmin. This occurs in application/core/Survey_Common_Action.php