CVE-2021-44967

A Remote Code Execution (RCE) vulnerabilty exists in LimeSurvey 5.2.4 via the upload and install plugins function, which could let a remote malicious user…

published February 22, 2022

CVSS
—
EPSS
14%
Percentile
96.4
In the wild
Unconfirmed
What it is

A Remote Code Execution (RCE) vulnerabilty exists in LimeSurvey 5.2.4 via the upload and install plugins function, which could let a remote malicious user upload an arbitrary PHP code file. NOTE: the Supplier's position is that plugins intentionally can contain arbitrary PHP code, and can only be installed by a superadmin, and therefore the security model is not violated by this finding.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.13502 · 96.4th percentile
Published
2022-02-22T21:17Z
EPSS history
Timeline
  • 22 FEB 21:17Z
    A Remote Code Execution (RCE) vulnerabilty exists in LimeSurvey 5.2.4 via the upload and install plugins function, which could let a remote malicious user…
    cvelistv5