PT-2010-4292 · Piwik · Piwik

Enrico Razza · Published 2010-08-02 · Updated 2019-11-21 · CVE-2010-2786

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Piwik versions 0.6 through 0.6.3

Description The issue allows remote attackers to include arbitrary local files and possibly have other impacts via directory traversal sequences in a crafted data-renderer request.

Recommendations For Piwik versions 0.6 through 0.6.3, update to a version later than 0.6.3 to resolve the issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2010-2786

Affected Products

Piwik

References · 11

• http://secunia.com/advisories/40703 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-2786 · Security Note
• http://vupen.com/english/advisories/2010/1971 · Vendor Advisory
• http://osvdb.org/66759 · Note
• http://marc.info/?l=oss-security&m=128032989120346&w=2 · Note
• http://marc.info/?l=oss-security&m=128041221832498&w=2 · Note
• http://piwik.org/blog/2010/07/piwik-0-6-4-security-advisory · Note
• http://piwik.org/changelog · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/60808 · Note
• http://securityfocus.com/bid/42031 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2786 · Note