PT-2011-2321 · Piwik · Piwik

Robocoder · Publicado 2011-01-10 · Atualizado 2019-11-21 · CVE-2011-0400

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Piwik versions prior to 1.1

Description The issue allows remote attackers to capture the session cookie by intercepting its transmission within an http session, as the secure flag for the session cookie is not set in an https session.

Recommendations For versions prior to 1.1, update to version 1.1 or later to set the secure flag for the session cookie in an https session.

Correção

Enumeração de Fraquezas

CWE-16

Identificadores relacionados

CVE-2011-0400

Produtos afetados

Piwik

Referências · 7

• http://dev.piwik.org/trac/ticket/1795 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64639 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-0400 · Nota de Segurança
• http://piwik.org/blog/2011/01/piwik-1-1-2 · Correção
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0400 · Nota
• http://securityfocus.com/bid/45787 · Nota
• http://osvdb.org/70382 · Nota