Security readout for executives and security teams
Plain-English summary
This CVE describes a CSRF issue in LimeSurvey 3.0.0-beta.3+17110 where an administrator could be tricked into deleting Boxes. The public record says it appears fixed in 3.6.x, but provides no CVSS score, formal affected CPEs, or exploitation evidence.
Executive priority
Treat this as a targeted hygiene item, not an emergency, unless vulnerable LimeSurvey admin panels are broadly accessible or box deletion affects business-critical surveys. Prioritize upgrade verification because the public record is incomplete.
Technical view
The issue is a Cross-Site Request Forgery weakness in the LimeSurvey Boxes feature. The documented outcome is administrator-triggered deletion of boxes. Source metadata is sparse: no CWE, no CVSS vector, and no normalized affected product list beyond the version named in the description.
Likely exposure
Exposure is most likely for organizations running LimeSurvey 3.0.0-beta.3+17110 or nearby pre-3.6.x builds with administrator access enabled. The source bundle does not identify affected CPEs or confirm whether supported stable releases were impacted.
Exploitation context
No active exploitation is reported in the provided sources, and the CVE is not listed as KEV. The described attack class would depend on an authenticated administrator context and a forged action causing deletion, but the sources do not provide operational exploit details.
Researcher notes
The evidence base is thin. The CVE description names LimeSurvey 3.0.0-beta.3+17110 and says the issue appears fixed in 3.6.x, but does not provide a CVSS score, CWE, CPEs, exploit status, or detailed patch advisory.
Mitigation direction
- Confirm current LimeSurvey version and whether it predates the 3.6.x fix line.
- Upgrade to a vendor-supported fixed version after checking LimeSurvey guidance.
- Restrict LimeSurvey administrator access to trusted users and networks.
- Review admin workflows for unexpected box deletion risk.
- Maintain backups so deleted boxes or configuration can be restored.
Validation and detection
- Inventory all LimeSurvey instances and record exact version numbers.
- Check whether any instance matches 3.0.0-beta.3+17110 or pre-3.6.x builds.
- Review administrative audit logs for unexpected box deletion events.
- Confirm upgraded instances include CSRF protection for box deletion actions.
- Document residual uncertainty where version impact cannot be verified.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-1000514 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://bugs.limesurvey.org/view.php?id=13562CVE reference · x_refsource_MISC
- https://bugs.limesurvey.org/plugin.php?page=Source/view&id=26925CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.