CVE-2019-16184: Improper Neutralization of Formula Elements in a CSV File (CWE-1236)
value: A CSV injection vulnerability was found in Limesurvey before 3.17.14 that allows survey participants to inject commands via their survey responses that will be included in the export CSV file.
CWE description: The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
CVSS v3 base score: 9.8
Published: 2019-09-09T21:15Z
Repository: https://github.com/LimeSurvey/LimeSurvey
Language: PHP
Files changed: application/config/version.php, docs/release_notes.txt
Commit date: 2019-09-02 10:43:10 +0200
Commit message: Release 3.17.14+190902

Diff: diff --git a/application/config/version.php b/application/config/version.php
index faca17fa623..b4fb4714cdd 100644
--- a/application/config/version.php
+++ b/application/config/version.php
@@ -10,11 +10,11 @@
  * other free or open source software licenses.
  * See COPYRIGHT.php for copyright notices and details.
  */
 
 
-$config['versionnumber'] = '3.17.13';
+$config['versionnumber'] = '3.17.14';
 $config['dbversionnumber'] = 359;
 $config['buildnumber'] = '';
 $config['updatable'] = true;
-$config['assetsversionnumber'] = '30095';
+$config['assetsversionnumber'] = '30096';
 return $config;
diff --git a/docs/release_notes.txt b/docs/release_notes.txt
index a3718804316..95993aaff20 100644
--- a/docs/release_notes.txt
+++ b/docs/release_notes.txt
@@ -32,10 +32,50 @@ https://manual.limesurvey.org/Upgrading_from_a_previous_version
 Thank you to everyone who helped with this new release!
 
 
 CHANGE LOG
 ------------------------------------------------------
+Changes from 3.17.13 (build 190824) to 3.17.14 (build 190902) September 2, 2019
+-Fixed issue: setting "Show header in answers export PDFs" not taken in account (LouisGac)
+-Fixed issue: [security]XSS in admin box buttons - kindly reported by Pavol Michalec & Frederik Koľbík (Carsten Schmitz)
+-Fixed issue: [security]XML breakout possible on export - kindly reported by Pavol Michalec & Frederik Koľbík (Carsten Schmitz)
+-Fixed issue: [security]X-Frame-Options SAMEORIGIN not set by default - kindly reported by Pavol Michalec & Frederik Koľbík (Carsten Schmitz)
+-Fixed issue: [security]User unaware that SSL encryption should be enforced (Carsten Schmitz)
+-Fixed issue: [security]Path revelation (Carsten Schmitz)
+-Fixed issue: [security]LDAP login non-generic login message - kindly reported by Pavol Michalec & Frederik Koľbík (Carsten Schmitz)
+-Fixed issue: [security]LDAP login non-generic login message - kindly reported by Pavol Michalec & Frederik Koľbík (Carsten Schmitz)
+-Fixed issue: [security]Equation signs are not masked by default on data export (Carsten Schmitz)
+-Fixed issue: [security]Equation signs are not masked by default on data export (Carsten Schmitz)
+-Fixed issue: [security]CSRF cookie missing HTTP only parameter- kindly reported by Pavol Michalec & Frederik Koľbík (Carsten Schmitz)
+-Fixed issue: [security]Admin user without permissions can still see plugins page - kindly reported by Pavol Michalec & Frederik Koľbík (Carsten Schmitz)
+-Fixed issue: [security]Admin user with settings permissions can can run integrity check - kindly reported by Pavol Michalec & Frederik Koľbík (Carsten Schmitz)
+-Fixed issue: [security]Admin user with limited permissions can view/update/delete reserved menu entries (Carsten Schmitz)
+-Fixed issue: [security]Admin user can mark other user notification as read (Carsten Schmitz)
+-Fixed issue: [security] Database backup uses browser cache (Carsten Schmitz)
+-Fixed issue: [security] Browser cache used for exports (Carsten Schmitz)
+-Fixed issue: [security] #15204: Stored XSS vulnerabilities - Thanks to J. Greil from the SEC Consult Vulnerability Lab (https://www.sec-consult.com) (Denis Chenu)
+-Fixed issue: [security] #15204: Reflected XSS vulnerabilities - thanks to J. Greil from  the  SEC  Consult Vulnerability Lab (Denis Chenu)
+-Fixed issue: Survey upload self-reflecting XSS (Carsten Schmitz)
+-Fixed issue: Sidebar not working on IE11 (lacrioque)
+-Fixed issue: Memory issues if too many responses exist for the same token in a non-anonymous survey (Carsten Schmitz)
+-Fixed issue: Memory issues if too many responses exist for the same token in a non-anonymous survey (Carsten Schmitz)
+-Fixed issue: LsTutorial only working in debug mode (lacrioque)
+-Fixed issue: Language not updated on import and overwrite in CPDB (lacrioque)
+-Fixed issue: JS error in firstStartTour onShow code (#1315) (Martin Unkel)
+-Fixed issue: After survey activation the ExpressionManager cache was not updated (Carsten Schmitz)
+-Fixed issue #15212: Survey navigation shows message "Please use the survey navigation buttons...[]" instead of navigating (Carsten Schmitz)
+-Fixed issue #15209: 500 error when try to save long administrator name (Denis Chenu)
+-Fixed issue #15208: MSSQL error on 2nd page of theme (Denis Chenu)
+-Fixed issue #15199: MSSQL : date/time question are not reloaded properly (Denis Chenu)
+-Fixed issue #15197: Submitting empty menu entry crashes application ( Application Denial of Service) (lacrioque)
+-Fixed issue #15194: Unable to remove page title from PDF generated at "print answers" screen (LouisGac)
+-Fixed issue #15192: entering html code inside the answeroptions for List type questions will break/alter the html for editing answers (Patrick Teichmann)
+-Fixed issue #15188: Access Label sets list (lacrioque)
+-Fixed issue #14863: Extending core theme using the same core theme name (Eddy Lackmann)
+-Fixed issue #10168: Commit test! Ignore (Carsten Schmitz)
+-New translation: Filipino (Carsten Schmitz)
+
 Changes from 3.17.12 (build 190823) to 3.17.13 (build 190824) August 24, 2019
 -Fixed issue #15185: Surveys with less or more then 4-6 digits will not display the sidepanel (Patrick Teichmann)
 
 
 Changes from 3.17.11 (build 190822) to 3.17.12 (build 190823) August 23, 2019

Vulnerable code: $config['versionnumber'] = '3.17.13';
$config['assetsversionnumber'] = '30095';
Fixed code: $config['versionnumber'] = '3.17.14';
$config['assetsversionnumber'] = '30096';
Changes from 3.17.13 (build 190824) to 3.17.14 (build 190902) September 2, 2019
-Fixed issue: setting "Show header in answers export PDFs" not taken in account (LouisGac)
-Fixed issue: [security]XSS in admin box buttons - kindly reported by Pavol Michalec & Frederik Koľbík (Carsten Schmitz)
-Fixed issue: [security]XML breakout possible on export - kindly reported by Pavol Michalec & Frederik Koľbík (Carsten Schmitz)
-Fixed issue: [security]X-Frame-Options SAMEORIGIN not set by default - kindly reported by Pavol Michalec & Frederik Koľbík (Carsten Schmitz)
-Fixed issue: [security]User unaware that SSL encryption should be enforced (Carsten Schmitz)
-Fixed issue: [security]Path revelation (Carsten Schmitz)
-Fixed issue: [security]LDAP login non-generic login message - kindly reported by Pavol Michalec & Frederik Koľbík (Carsten Schmitz)
-Fixed issue: [security]LDAP login non-generic login message - kindly reported by Pavol Michalec & Frederik Koľbík (Carsten Schmitz)
-Fixed issue: [security]Equation signs are not masked by default on data export (Carsten Schmitz)
-Fixed issue: [security]Equation signs are not masked by default on data export (Carsten Schmitz)
-Fixed issue: [security]CSRF cookie missing HTTP only parameter- kindly reported by Pavol Michalec & Frederik Koľbík (Carsten Schmitz)
-Fixed issue: [security]Admin user without permissions can still see plugins page - kindly reported by Pavol Michalec & Frederik Koľbík (Carsten Schmitz)
-Fixed issue: [security]Admin user with settings permissions can can run integrity check - kindly reported by Pavol Michalec & Frederik Koľbík (Carsten Schmitz)
-Fixed issue: [security]Admin user with limited permissions can view/update/delete reserved menu entries (Carsten Schmitz)
-Fixed issue: [security]Admin user can mark other user notification as read (Carsten Schmitz)
-Fixed issue: [security] Database backup uses browser cache (Carsten Schmitz)
-Fixed issue: [security] Browser cache used for exports (Carsten Schmitz)
-Fixed issue: [security] #15204: Stored XSS vulnerabilities - Thanks to J. Greil from the SEC Consult Vulnerability Lab (https://www.sec-consult.com) (Denis Chenu)
-Fixed issue: [security] #15204: Reflected XSS vulnerabilities - thanks to J. Greil from  the  SEC  Consult Vulnerability Lab (Denis Chenu)
-Fixed issue: Survey upload self-reflecting XSS (Carsten Schmitz)
-Fixed issue: Sidebar not working on IE11 (lacrioque)
-Fixed issue: Memory issues if too many responses exist for the same token in a non-anonymous survey (Carsten Schmitz)
-Fixed issue: Memory issues if too many responses exist for the same token in a non-anonymous survey (Carsten Schmitz)
-Fixed issue: LsTutorial only working in debug mode (lacrioque)
-Fixed issue: Language not updated on import and overwrite in CPDB (lacrioque)
-Fixed issue: JS error in firstStartTour onShow code (#1315) (Martin Unkel)
-Fixed issue: After survey activation the ExpressionManager cache was not updated (Carsten Schmitz)
-Fixed issue #15212: Survey navigation shows message "Please use the survey navigation buttons...[]" instead of navigating (Carsten Schmitz)
-Fixed issue #15209: 500 error when try to save long administrator name (Denis Chenu)
-Fixed issue #15208: MSSQL error on 2nd page of theme (Denis Chenu)
-Fixed issue #15199: MSSQL : date/time question are not reloaded properly (Denis Chenu)
-Fixed issue #15197: Submitting empty menu entry crashes application ( Application Denial of Service) (lacrioque)
-Fixed issue #15194: Unable to remove page title from PDF generated at "print answers" screen (LouisGac)
-Fixed issue #15192: entering html code inside the answeroptions for List type questions will break/alter the html for editing answers (Patrick Teichmann)
-Fixed issue #15188: Access Label sets list (lacrioque)
-Fixed issue #14863: Extending core theme using the same core theme name (Eddy Lackmann)
-Fixed issue #10168: Commit test! Ignore (Carsten Schmitz)
-New translation: Filipino (Carsten Schmitz)