CVE-2019-16187

Limesurvey before 3.17.14 uses an anti-CSRF cookie without the HttpOnly flag, which allows attackers to access a cookie value via a client-side script

published September 9, 2019

CVSS
—
EPSS
1%
Percentile
72.0
In the wild
Unconfirmed
What it is

Limesurvey before 3.17.14 uses an anti-CSRF cookie without the HttpOnly flag, which allows attackers to access a cookie value via a client-side script.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01387 · 72.0th percentile
Published
2019-09-09T20:21Z
EPSS history
Timeline
  • 09 SEP 20:21Z
    Limesurvey before 3.17.14 uses an anti-CSRF cookie without the HttpOnly flag, which allows attackers to access a cookie value via a client-side script
    cvelistv5