CVE-2018-7556

CRITICAL

LimeSurvey <2.6.7, 2.7x.x<2.73.1, 3.x<3.4.2 - Sensitive Information Exposure

Title source: llm

Description

LimeSurvey 2.6.x before 2.6.7, 2.7x.x before 2.73.1, and 3.x before 3.4.2 mishandles application/controller/InstallerController.php after installation, which allows remote attackers to access the configuration file.

References (1)

Core 1

Core References

Vendor Advisory x_refsource_confirm

https://www.limesurvey.org/about-us/news/2075-limesurvey-security-advisory-02-2018

Scores

CVSS v3 9.1

EPSS 0.0201

EPSS Percentile 78.5%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Details

CWE

CWE-200

Status published

Products (2)

debian/debian_linux 7.0

limesurvey/limesurvey 2.6.0 - 2.6.7

Published Feb 28, 2018

Tracked Since Feb 18, 2026