PT-2015-7626 · Piwik · Piwik

Egidio Romano · Publicado 2015-11-16 · Atualizado 2019-11-21 · CVE-2015-7816

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Piwik versions prior to 2.15.0

Description The issue allows remote attackers to conduct PHP object injection attacks, conduct Server-Side Request Forgery (SSRF) attacks, and execute arbitrary PHP code via a crafted HTTP header. This is due to a problem in the DisplayTopKeywords function in plugins/Referrers/Controller.php.

Recommendations For versions prior to 2.15.0, update to version 2.15.0 or later to resolve the issue.

Exploit

Correção

Identificadores relacionados

CVE-2015-7816

Produtos afetados

Piwik

Referências · 7

• 🔥 http://seclists.org/fulldisclosure/2015/Nov/15 · Exploit
• 🔥 http://packetstormsecurity.com/files/134220/Piwik-2.14.3-PHP-Object-Injection.html · Exploit
• 🔥 http://karmainsecurity.com/KIS-2015-10 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-7816 · Nota de Segurança
• https://piwik.org/changelog/piwik-2-15-0 · Aviso do Fabricante
• http://securityfocus.com/archive/1/536839/100/0/threaded · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7816 · Nota