CVE-2025-41076

In version 6.13.0 of LimeSurvey, any external user can cause a 500 error in the survey system by sending a malformed session cookie. Instead of displaying a generic error message, the system exposes internal backend information, including the use of the Yii framework, the MySQL/MariaDB database engine, the table name 'lime_sessions', primary keys, and fragments of the content that caused the conflict. This information can simplify the collection of data about the internal architecture of the application by an attacker.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-limesurvey-0	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:limesurvey:limesurvey:6.13.0:*:*:*:*:*:*:*

History

19 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) En la versión 6.13.0 de LimeSurvey, cualquier usuario externo puede causar un error 500 en el sistema de encuestas enviando una 'cookie' de 'sesión' malformada. En lugar de mostrar un mensaje de error genérico, el sistema expone información interna del backend, incluyendo el uso del 'framework' Yii, el motor de 'base de datos' 'MySQL'/MariaDB, el nombre de la tabla 'lime_sessions', las claves primarias y fragmentos del contenido que causó el conflicto. Esta información puede simplificar la recopilación de datos sobre la arquitectura interna de la aplicación por un 'atacante'.

Information

Published : 2025-11-20 15:17

Updated : 2026-10-19 13:10

NVD link : CVE-2025-41076

Mitre link : CVE-2025-41076

CVE.ORG link : CVE-2025-41076

JSON object : View

Products Affected

limesurvey

limesurvey

CWE

CWE-209

Generation of Error Message Containing Sensitive Information

{"id": "CVE-2025-41076", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-41076", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-20T20:16:44.385041Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "cve-coordination@incibe.es", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cve-coordination@incibe.es", "affectedData": [{"vendor": "LimeSurvey", "product": "LimeSurvey", "versions": [{"status": "affected", "version": "6.13.0"}], "defaultStatus": "unaffected"}]}], "published": "2025-11-20T15:17:29.427", "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-limesurvey-0", "tags": ["Third Party Advisory"], "source": "cve-coordination@incibe.es"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve-coordination@incibe.es", "description": [{"lang": "en", "value": "CWE-209"}]}], "descriptions": [{"lang": "en", "value": "In version 6.13.0 of LimeSurvey, any external user can cause a 500 error in the survey system by sending a malformed session cookie. Instead of displaying a generic error message, the system exposes internal backend information, including the use of the Yii framework, the MySQL/MariaDB database engine, the table name 'lime_sessions', primary keys, and fragments of the content that caused the conflict. This information can simplify the collection of data about the internal architecture of the application by an attacker."}, {"lang": "es", "value": "En la versi\u00f3n 6.13.0 de LimeSurvey, cualquier usuario externo puede causar un error 500 en el sistema de encuestas enviando una 'cookie' de 'sesi\u00f3n' malformada. En lugar de mostrar un mensaje de error gen\u00e9rico, el sistema expone informaci\u00f3n interna del backend, incluyendo el uso del 'framework' Yii, el motor de 'base de datos' 'MySQL'/MariaDB, el nombre de la tabla 'lime_sessions', las claves primarias y fragmentos del contenido que caus\u00f3 el conflicto. Esta informaci\u00f3n puede simplificar la recopilaci\u00f3n de datos sobre la arquitectura interna de la aplicaci\u00f3n por un 'atacante'."}], "lastModified": "2026-10-19T13:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:limesurvey:limesurvey:6.13.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "61C66C1A-C073-41C9-B847-F55896D4A6E2"}], "operator": "OR"}]}], "sourceIdentifier": "cve-coordination@incibe.es"}