CVE-2017-18358: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: LimeSurvey before 2.72.4 has Stored XSS by using the Continue Later (aka Resume later) feature to enter an email address, which is mishandled in the admin panel.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-01-15T16:29Z
Repository: https://github.com/LimeSurvey/LimeSurvey
Language: PHP
Files changed: application/config/version.php, docs/release_notes.txt
Commit date: 2017-11-10 11:08:54 +0100
Commit message: Release 2.72.4+171110

Diff: diff --git a/application/config/version.php b/application/config/version.php
index 0428295d0c..26c27c6a6e 100644
--- a/application/config/version.php
+++ b/application/config/version.php
@@ -10,13 +10,13 @@
  * other free or open source software licenses.
  * See COPYRIGHT.php for copyright notices and details.
  *150413
  */
 
-$config['versionnumber'] = '2.72.3';
+$config['versionnumber'] = '2.72.4';
 $config['dbversionnumber'] = 263;
 $config['buildnumber'] = '';
 $config['updatable'] = true;
-$config['assetsversionnumber'] = '2723';
+$config['assetsversionnumber'] = '2724';
 return $config;
 
 ?>
diff --git a/docs/release_notes.txt b/docs/release_notes.txt
index 2a6b0c7f3b..f6effd8076 100644
--- a/docs/release_notes.txt
+++ b/docs/release_notes.txt
@@ -33,10 +33,48 @@ Thank you to everyone who helped with this new release!
 
 
 CHANGE LOG
 ------------------------------------------------------
 
+Changes from 2.72.3 (build 171020) to 2.72.4 (build 171020) Nov 10, 2017
+-Fixed issue: [Security] Possible to edit file outside of template directory from template editor (found and reported by Robin Peraglie from RIPS Technologies www.ripstech.com ) (LouisGac)
+-Fixed issue: [Security] Possible XSS in Resume later function (found and reported by Robin Peraglie from RIPS Technologies www.ripstech.com ) (Carsten Schmitz)
+-Fixed issue #12697: SPSS Export - responses truncated for incomplete answers (Denis Chenu)
+-Fixed issue #12734: SPSS exporting complete or uncomplete make different syntax (Denis Chenu)
+-Fixed issue #12851: Regex for trailing zeroes in numeric input matches only zeroes immediately after decimal sign (markusfluer)
+-Fixed issue #12866: Some participants cannot be saved for no obvious reason (Carsten Schmitz)
+-Fixed issue #12873: Captcha breaking token persistence (LouisGac)
+-Fixed issue #12876: Survey logic file completely unprintable (markusfluer)
+-Fixed issue: Deprecated error shown when using user statistics (Carsten Schmitz)
+#Updated translation: Arabic by Macropsyco, Macropsy
+#Updated translation: Bosnian by RebeccaAwdry
+#Updated translation: Catalan by qualitatuvic
+#Updated translation: Czech by jelen1, VBraun
+#Updated translation: Dutch by zfocuz, Han
+#Updated translation: Dutch (Informal) by zfocuz, Han
+#Updated translation: Finnish by jeskiv
+#Updated translation: French (France) by arnaud21
+#Updated translation: German by tuxmaster, c_schmitz
+#Updated translation: German (Informal) by tuxmaster, c_schmitz
+#Updated translation: Hungarian by kkd
+#Updated translation: Indonesian by bennylin, ysulistya, radhwaw
+#Updated translation: Italian by lfanfoni
+#Updated translation: Italian (Informal) by lfanfoni
+#Updated translation: Japanese by nomoto
+#Updated translation: Kirundi by Vicks
+#Updated translation: Norwegian (Bokmål) by pmonstad
+#Updated translation: Norwegian (Nynorsk) by pmonstad
+#Updated translation: Persian by ESH, UTeQ
+#Updated translation: Polish by elissa
+#Updated translation: Polish (Informal) by elissa
+#Updated translation: Portuguese (Brazil) by mauriciofurtado
+#Updated translation: Portuguese (Portugal) by c_schmitz
+#Updated translation: Romanian by cookiemonster, jmlorenzo, vundicind, icm76, enedelcu
+#Updated translation: Russian by vipgroup
+#Updated translation: Swedish by maxzomborszki
+#Updated translation: Turkish by kayazeren
+
 Changes from 2.72.2 (build 171017) to 2.72.3 (build 171020) Oct 20, 2017
 -Fixed issue #12805: Date fields are lost when persistent tokens are re-accessed (Carsten Schmitz)
 -Fixed issue #12806: RemoteControl: wrong datatype shows SQL error (Carsten Schmitz)
 -Fixed issue: Error after update which resolves itself after some time (caching issue) (Carsten Schmitz)
 -Fixed issue: Error message on LDAP token bind too generic (Carsten Schmitz)

Vulnerable code: $config['versionnumber'] = '2.72.3';
$config['assetsversionnumber'] = '2723';
Fixed code: $config['versionnumber'] = '2.72.4';
$config['assetsversionnumber'] = '2724';
Changes from 2.72.3 (build 171020) to 2.72.4 (build 171020) Nov 10, 2017
-Fixed issue: [Security] Possible to edit file outside of template directory from template editor (found and reported by Robin Peraglie from RIPS Technologies www.ripstech.com ) (LouisGac)
-Fixed issue: [Security] Possible XSS in Resume later function (found and reported by Robin Peraglie from RIPS Technologies www.ripstech.com ) (Carsten Schmitz)
-Fixed issue #12697: SPSS Export - responses truncated for incomplete answers (Denis Chenu)
-Fixed issue #12734: SPSS exporting complete or uncomplete make different syntax (Denis Chenu)
-Fixed issue #12851: Regex for trailing zeroes in numeric input matches only zeroes immediately after decimal sign (markusfluer)
-Fixed issue #12866: Some participants cannot be saved for no obvious reason (Carsten Schmitz)
-Fixed issue #12873: Captcha breaking token persistence (LouisGac)
-Fixed issue #12876: Survey logic file completely unprintable (markusfluer)
-Fixed issue: Deprecated error shown when using user statistics (Carsten Schmitz)
#Updated translation: Arabic by Macropsyco, Macropsy
#Updated translation: Bosnian by RebeccaAwdry
#Updated translation: Catalan by qualitatuvic
#Updated translation: Czech by jelen1, VBraun
#Updated translation: Dutch by zfocuz, Han
#Updated translation: Dutch (Informal) by zfocuz, Han
#Updated translation: Finnish by jeskiv
#Updated translation: French (France) by arnaud21
#Updated translation: German by tuxmaster, c_schmitz
#Updated translation: German (Informal) by tuxmaster, c_schmitz
#Updated translation: Hungarian by kkd
#Updated translation: Indonesian by bennylin, ysulistya, radhwaw
#Updated translation: Italian by lfanfoni
#Updated translation: Italian (Informal) by lfanfoni
#Updated translation: Japanese by nomoto
#Updated translation: Kirundi by Vicks
#Updated translation: Norwegian (Bokmål) by pmonstad
#Updated translation: Norwegian (Nynorsk) by pmonstad
#Updated translation: Persian by ESH, UTeQ
#Updated translation: Polish by elissa
#Updated translation: Polish (Informal) by elissa
#Updated translation: Portuguese (Brazil) by mauriciofurtado
#Updated translation: Portuguese (Portugal) by c_schmitz
#Updated translation: Romanian by cookiemonster, jmlorenzo, vundicind, icm76, enedelcu
#Updated translation: Russian by vipgroup
#Updated translation: Swedish by maxzomborszki
#Updated translation: Turkish by kayazeren