Hi Guys,

On our recent Nessus scan the following vulnerability popped up:

The following CGIs are not protected by a random token :
/limesurvey/

Anyone has any idea how to mitigate this ?

We are using version 3.17.4 (build 190529)

Thank you.

There are no ($_POST) form in limesurvey home page, then no need to protect it against CRSF.

All forms inside limesurvey are protected against CRSF, if not it's an issue. But not here.

So i consider this as a false positive.

Thank you Denis.

Yep,

I check again : the language switch are on GET request only.
And it does only language switching : no data are really send.