DWSurvey vulnerabilities

DWSurvey v6.14.0 is vulnerable to authentication bypass via the '/api/dwsurvey/none/' and '/api/dwsurvey/up/**' parameters.

A vulnerability in DWSurvey up to 6.14.0 affects an unknown function in the file /api/dwsurvey/app/survey/up-survey-status.do of the Survey Status Handler component. This manipulation causes improper authorization. The attack can be initiated remotely, and the exploit has been publicly disclosed.

A vulnerability was found in DWSurvey up to version 6.14.0 in the function DwDeisgnSurveyController.devSurvey in the file /api/dwsurvey/app/v6/dw-design-survey/dev-survey.do. Manipulation leads to authorization bypass. The attack can be launched remotely, and the exploit has been made public.

DWSurvey 6.14.0 is vulnerable to Incorrect Access Control. When deleting a questionnaire, replacing the questionnaire ID with the ID of another questionnaire can enable the deletion of other questionnaires.