Description

LimeSurvey 2.6.x before 2.6.7, 2.7x.x before 2.73.1, and 3.x before 3.4.2 mishandles application/controller/InstallerController.php after installation, which allows remote attackers to access the configuration file.

Remediation

References

CVE-2018-7556

Related Vulnerabilities

WordPress Plugin WP Visitor Statistics (Real Time Traffic) SQL Injection (5.7)

WordPress Plugin WP Fast Cache Multiple Vulnerabilities (1.4)

Joomla Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-23800)

Joomla Missing Authorization Vulnerability (CVE-2019-18674)

b2evolution Credentials Management Errors Vulnerability (CVE-2016-9479)

Severity

Critical

Classification

CVE-2018-7556 CWE-200 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Tags

Missing Update Known Vulnerabilities