Vulnerability Details CVE-2012-4995
Cross-site scripting (XSS) vulnerability in admin/userrighthandling.php in LimeSurvey before 1.91+ Build 120224 allows remote attackers to inject arbitrary web script or HTML via the full_name parameter in a moduser action to admin/admin.php. NOTE: some of these details are obtained from third party information.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 55.3%
CVSS Severity
CVSS v2 Score 4.3
References
- http://freecode.com/projects/limesurvey/releases/342070
- http://osvdb.org/79687
- http://secunia.com/advisories/48184
- http://www.limesurvey.org/en/stable-release
- https://exchange.xforce.ibmcloud.com/vulnerabilities/73563
- http://freecode.com/projects/limesurvey/releases/342070
- http://osvdb.org/79687
- http://secunia.com/advisories/48184
- http://www.limesurvey.org/en/stable-release
- https://exchange.xforce.ibmcloud.com/vulnerabilities/73563
Products affected by CVE-2012-4995
-
cpe:2.3:a:limesurvey:limesurvey:1.01
-
cpe:2.3:a:limesurvey:limesurvey:1.45
-
cpe:2.3:a:limesurvey:limesurvey:1.50
-
cpe:2.3:a:limesurvey:limesurvey:1.52
-
cpe:2.3:a:limesurvey:limesurvey:1.53
-
cpe:2.3:a:limesurvey:limesurvey:1.53+
-
cpe:2.3:a:limesurvey:limesurvey:1.70
-
cpe:2.3:a:limesurvey:limesurvey:1.70+
-
cpe:2.3:a:limesurvey:limesurvey:1.71
-
cpe:2.3:a:limesurvey:limesurvey:1.71+
-
cpe:2.3:a:limesurvey:limesurvey:1.72
-
cpe:2.3:a:limesurvey:limesurvey:1.80
-
cpe:2.3:a:limesurvey:limesurvey:1.80+
-
cpe:2.3:a:limesurvey:limesurvey:1.81
-
cpe:2.3:a:limesurvey:limesurvey:1.81+
-
cpe:2.3:a:limesurvey:limesurvey:1.82
-
cpe:2.3:a:limesurvey:limesurvey:1.82+
-
cpe:2.3:a:limesurvey:limesurvey:1.85
-
cpe:2.3:a:limesurvey:limesurvey:1.86
-
cpe:2.3:a:limesurvey:limesurvey:1.87
-
cpe:2.3:a:limesurvey:limesurvey:1.87+
-
cpe:2.3:a:limesurvey:limesurvey:1.90
-
cpe:2.3:a:limesurvey:limesurvey:1.90+
-
cpe:2.3:a:limesurvey:limesurvey:1.91
-
cpe:2.3:a:limesurvey:limesurvey:1.91+