PT-2019-12702 · Matomo · Matomo

Gionathan Armando Reale · Publicado 2019-05-20 · Atualizado 2024-08-05 · CVE-2019-12215

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Matomo version 3.9.1

Description A full path disclosure issue was discovered, allowing a user to trigger an error and discover the full path of Matomo on the disk. This occurs because lastError.file is used in plugins/CorePluginsAdmin/templates/safemode.twig. The vendor disputes the significance of this issue.

Recommendations For Matomo version 3.9.1, consider modifying the safemode.twig template to avoid disclosing the full path when an error occurs, or restrict access to the CorePluginsAdmin plugin until a fix is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Generation of Error Message Containing Sensitive Information

Enumeração de Fraquezas

CWE-209

Identificadores relacionados

CVE-2019-12215

Produtos afetados

Matomo

Referências · 4

• 🔥 https://github.com/matomo-org/matomo/issues/14464 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-12215 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-12215 · Aviso do Fabricante
• https://t.me/cvenotify/89070 · Publicação no Telegram