WS-2023-0238 | Mend Vulnerability Database

Vulnerability DatabaseWS-2023-0238

WS-2023-0238

Published:May 15, 2026

Updated:May 15, 2026

CSRF in the delete notification function in limesurvey/limesurvey

Affected Packages

limesurvey/limesurvey (PHP):

Affected version(s) >=3.28.15+220616 <3.28.18+220706

Fix Suggestion:

Update to version 3.28.18+220706

limesurvey/limesurvey (PHP):

Affected version(s) =dev-dev-clean-survey-model <dev-dev-feature-api-add-quota-completeCount

Fix Suggestion:

Update to version dev-dev-feature-api-add-quota-completeCount

limesurvey/limesurvey (PHP):

Affected version(s) >=4.1.18+200416 <5.3.7+220328

Fix Suggestion:

Update to version 5.3.7+220328

limesurvey/limesurvey (PHP):

Affected version(s) >=3.0.2+180110 <3.23.5+200923

Fix Suggestion:

Update to version 3.23.5+200923

limesurvey/limesurvey (PHP):

Affected version(s) >=dev-snyk-fix-76cf46bd82f4347fa5bd130cdd788057 <=dev-snyk-upgrade-b8f4dac44087b061e2e7d08aa4d95731

Fix Suggestion:

Update to version no_fix

limesurvey/limesurvey (PHP):

Affected version(s) >=dev-tests-lchtest <dev-travis-postgre

Fix Suggestion:

Update to version dev-travis-postgre

limesurvey/limesurvey (PHP):

Affected version(s) >=dev-update-testing-dependencies <dev-scrutinizer-patch-1

Fix Suggestion:

Update to version dev-scrutinizer-patch-1

limesurvey/limesurvey (PHP):

Affected version(s) >=dev-dependabot/npm_and_yarn/assets/packages/adminbasics/terser-5.14.2 <dev-dependabot/npm_and_yarn/assets/packages/lstutorial/terser-5.14.2

Fix Suggestion:

Update to version dev-dependabot/npm_and_yarn/assets/packages/lstutorial/terser-5.14.2

limesurvey/limesurvey (PHP):

Affected version(s) =dev-add-app-params-to-twig <dev-add-before-get-template-event

Fix Suggestion:

Update to version dev-add-before-get-template-event

limesurvey/limesurvey (PHP):

Affected version(s) >=dev-dependabot/npm_and_yarn/assets/packages/questions/upload/loader-utils-2.0.3 <2.65.2+170606

Fix Suggestion:

Update to version 2.65.2+170606

limesurvey/limesurvey (PHP):

Affected version(s) >=5.3.8+220404 <5.3.26+220720

Fix Suggestion:

Update to version 5.3.26+220720

limesurvey/limesurvey (PHP):

Affected version(s) >=dev-snyk-upgrade-bc996b6b018fc6ea7d4263390981c31a <dev-tests-clieck-views1

Fix Suggestion:

Update to version dev-tests-clieck-views1

limesurvey/limesurvey (PHP):

Affected version(s) >=4.0.0-beta <4.1.17+200414

Fix Suggestion:

Update to version 4.1.17+200414

limesurvey/limesurvey (PHP):

Affected version(s) =dev-relevance-import2 <dev-scrutinizer-patch-2

Fix Suggestion:

Update to version dev-scrutinizer-patch-2

limesurvey/limesurvey (PHP):

Affected version(s) =dev-develop-innodb <dev-display-import-errors-master

Fix Suggestion:

Update to version dev-display-import-errors-master

kevinchappell/form-builder (PHP):

Affected version(s) =dev-dependabot/npm_and_yarn/terser-4.8.1 <dev-dependabot/npm_and_yarn/lodash-4.17.21

Fix Suggestion:

Update to version dev-dependabot/npm_and_yarn/lodash-4.17.21

limesurvey/limesurvey (PHP):

Affected version(s) >=dev-kill-travis <dev-model-find

Fix Suggestion:

Update to version dev-model-find

limesurvey/limesurvey (PHP):

Affected version(s) =3.27.34+220132 <3.27.35+220208

Fix Suggestion:

Update to version 3.27.35+220208

limesurvey/limesurvey (PHP):

Affected version(s) =dev-fix-spss-token-length <dev-fix-tests

Fix Suggestion:

Update to version dev-fix-tests

limesurvey/limesurvey (PHP):

Affected version(s) >=dev-v3-add-import-converter <3.0.1+171228

Fix Suggestion:

Update to version 3.0.1+171228

limesurvey/limesurvey (PHP):

Affected version(s) >=3.27.29+211214 <3.27.33+220125

Fix Suggestion:

Update to version 3.27.33+220125

limesurvey/limesurvey (PHP):

Affected version(s) >=dev-sid-spaces <dev-test-log-checks

Fix Suggestion:

Update to version dev-test-log-checks

limesurvey/limesurvey (PHP):

Affected version(s) >=dev-snyk-upgrade-db5589e32a61db42524a88ad04a6eaba <6.0.1+230411

Fix Suggestion:

Update to version 6.0.1+230411

limesurvey/limesurvey (PHP):

Affected version(s) >=dev-global-settings <dev-json-data

Fix Suggestion:

Update to version dev-json-data

limesurvey/limesurvey (PHP):

Affected version(s) =dev-dependabot/npm_and_yarn/assets/packages/questions/timer/loader-utils-1.4.2 <dev-detached2

Fix Suggestion:

Update to version dev-detached2

limesurvey/limesurvey (PHP):

Affected version(s) >=dev-new-scrutinizer <dev-scrutinizer-exclude-paths

Fix Suggestion:

Update to version dev-scrutinizer-exclude-paths

limesurvey/limesurvey (PHP):

Affected version(s) >=dev-em_quota <dev-fix-composer-license-format

Fix Suggestion:

Update to version dev-fix-composer-license-format

limesurvey/limesurvey (PHP):

Affected version(s) >=dev-scrutinizer-patch-3 <dev-survey-booleans3

Fix Suggestion:

Update to version dev-survey-booleans3

limesurvey/limesurvey (PHP):

Affected version(s) =dev-dependabot/npm_and_yarn/assets/packages/questions/upload/terser-5.14.2 <6.0.0+230405

Fix Suggestion:

Update to version 6.0.0+230405

limesurvey/limesurvey (PHP):

Affected version(s) =dev-fix-qngroup-phpdoc <dev-fix-relations-20230411

Fix Suggestion:

Update to version dev-fix-relations-20230411

limesurvey/limesurvey (PHP):

Affected version(s) >=3.28.20+220719 <dev-fixv3-16987

Fix Suggestion:

Update to version dev-fixv3-16987

limesurvey/limesurvey (PHP):

Affected version(s) >=dev-snyk-fix-a9c10ba47e88a08c83b32a913752ea82 <dev-snyk-upgrade-8e8193a6a781d5929de6292963cd2a21

Fix Suggestion:

Update to version dev-snyk-upgrade-8e8193a6a781d5929de6292963cd2a21

limesurvey/limesurvey (PHP):

Affected version(s) =dev-copy-question <dev-detached

Fix Suggestion:

Update to version dev-detached

limesurvey/limesurvey (PHP):

Affected version(s) =dev-fix-gitignore <dev-fix-model-relations

Fix Suggestion:

Update to version dev-fix-model-relations

limesurvey/limesurvey (PHP):

Affected version(s) >=dev-anonymize-tokens <dev-basic

Fix Suggestion:

Update to version dev-basic

limesurvey/limesurvey (PHP):

Affected version(s) =dev-develop <dev-develop-develop

Fix Suggestion:

Update to version dev-develop-develop

limesurvey/limesurvey (PHP):

Affected version(s) >=5.3.27+220725 <5.6.30+230711

Fix Suggestion:

Update to version 5.6.30+230711

limesurvey/limesurvey (PHP):

Affected version(s) >=2.65.6+170615 <3.0.0+171222

Fix Suggestion:

Update to version 3.0.0+171222

limesurvey/limesurvey (PHP):

Affected version(s) =2018012401.x-dev <dev-activator

Fix Suggestion:

Update to version dev-activator

limesurvey/limesurvey (PHP):

Affected version(s) >=3.23.6+200929 <3.27.28+211208

Fix Suggestion:

Update to version 3.27.28+211208

limesurvey/limesurvey (PHP):

Affected version(s) >=3.28.1+220229 <3.28.14+220608

Fix Suggestion:

Update to version 3.28.14+220608

Related Resources (1)

https://github.com/limesurvey/limesurvey/commit/b9622bc26560176cadd46d50dfdb1ef073fb632b

Do you need more information?

CVSS v4

Base Score:

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Attack Requirements

NONE

Privileges Required

NONE

User Interaction

PASSIVE

Vulnerable System Confidentiality

NONE

Vulnerable System Integrity

LOW

Vulnerable System Availability

NONE

Subsequent System Confidentiality

NONE

Subsequent System Integrity

NONE

Subsequent System Availability

NONE

CVSS v3

Base Score:

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

NONE

Integrity

LOW

Availability

NONE