What’s Vulnerable › Vulnerabilities

CVE-2024-39063

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-07-09 · updated 2026-06-17
• Weakness: CWE-352

Description

Lime Survey <= 6.5.12 is vulnerable to Cross Site Request Forgery (CSRF). The YII_CSRF_TOKEN is only checked when passed in the body of POST requests, but the same check isn't performed in the equivalent GET requests.

Affected products

• LimeSurvey: through 6.5.12

References

• https://github.com/sysentr0py/CVEs/tree/main/CVE-2024-39063
• https://github.com/sysentr0py/CVEs/tree/main/CVE-2024-39063

Get alerted when CVE-2024-39063 or the next vulnerability affects your stack