CVE-2024-6933

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-6933

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-6933.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-6933

Published

2024-07-21T00:31:04.336Z

Modified

2026-07-15T01:49:20.661742719Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

LimeSurvey Survey General Settings updatesurveylocalesettings_generalsettings actionUpdateSurveyLocaleSettingsGeneralSettings sql injection

Details

A flaw has been found in LimeSurvey 6.5.14-240624. Affected by this issue is the function actionUpdateSurveyLocaleSettingsGeneralSettings of the file /index.php?r=admin/database/index/updatesurveylocalesettings_generalsettings of the component Survey General Settings Handler. This manipulation of the argument Language causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version 6.6.2+240827 can resolve this issue. Patch name: d656d2c7980b7642560977f4780e64533a68e13d. You should upgrade the affected component.

Database specific

{
    "cwe_ids": [
        "CWE-74",
        "CWE-89"
    ],
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/6xxx/CVE-2024-6933.json"
}

References

Affected packages

Git / github.com/limesurvey/limesurvey

Affected ranges

Type

GIT

Repo

https://github.com/limesurvey/limesurvey

Events

Introduced

ac3c44744e2c3769b3941c41e50b68419423ce67

Fixed

6e875ef208606d963208b1fde4e99d875a73d73b

Fixed

d656d2c7980b7642560977f4780e64533a68e13d

Database specific

{
    "cpe": "cpe:2.3:a:limesurvey:limesurvey:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "6.5.14"
        },
        {
            "fixed": "6.6.2"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

6.*

6.5.14+240624

6.5.14-240624

6.5.15+240701

6.5.16+240708

6.5.17+240715

6.5.18+240723

6.6.0+240729

6.6.1+240806

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-6933.json"