PT-2009-3664 · Piwik · Piwik

Hanno Böck · Published 2009-03-25 · Updated 2019-11-21 · CVE-2009-1085

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Piwik versions 0.2.32 and earlier

Description The issue allows remote attackers to obtain sensitive information, including the API key, by making a direct request for the 'misc/cron/archive.sh' endpoint. This is due to insufficient access control for sensitive information stored under the web root.

Recommendations For Piwik versions 0.2.32 and earlier, consider restricting access to the 'misc/cron/archive.sh' endpoint to minimize the risk of exploitation. Additionally, ensure proper access controls are in place for sensitive information stored under the web root. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-1085

Affected Products

Piwik

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2009-1085 · Security Note
• http://marco-ziesing.de/archives/35-Schluesselloch-in-Piwik.html · Note
• http://dev.piwik.org/trac/ticket/599 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1085 · Note
• http://openwall.com/lists/oss-security/2009/03/23/2 · Note