PT-2011-2321 · Piwik · Piwik

Robocoder · Published 2011-01-10 · Updated 2019-11-21 · CVE-2011-0400

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Piwik versions prior to 1.1

Description The issue allows remote attackers to capture the session cookie by intercepting its transmission within an http session, as the secure flag for the session cookie is not set in an https session.

Recommendations For versions prior to 1.1, update to version 1.1 or later to set the secure flag for the session cookie in an https session.

Fix

Weakness Enumeration

CWE-16

Related Identifiers

CVE-2011-0400

Affected Products

Piwik

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2011-0400 · Security Note
• http://piwik.org/blog/2011/01/piwik-1-1-2 · Patch
• http://dev.piwik.org/trac/ticket/1795 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64639 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0400 · Note
• http://securityfocus.com/bid/45787 · Note
• http://osvdb.org/70382 · Note