The ability to edit groups owned by any user. in limesurvey/limesurvey
Valid
Reported on
Jun 15th 2023
Description
The edit group function does not check the owner, allowing for the possibility to modify a group without being the owner of that group.
Proof of Concept
Step 1: We have User1 who owns Group 1 and Group 2; User5 who owns Group 5.
Step 2: User1 performs an edit group action and changes the value of the ugid parameter to the groupId of User5.
Step 3: User1 successfully edits User5's group.
Impact
The ability to edit groups owned by any user.
We are processing your report and will contact the
limesurvey
team within 24 hours.
3 months ago
We have contacted a member of the
limesurvey
team and are waiting to hear back
3 months ago
What global permissions does User1 have in your scenario?
Internal reference (please ignore) : https://bugs.limesurvey.org/view.php?id=18915
The researcher has received a minor penalty to their credibility for miscalculating the severity: -1
The researcher's credibility has increased: +7
The fix bounty has been dropped
This vulnerability will not receive a CVE
to join this conversation