PT-2015-7626 · Piwik · Piwik

Egidio Romano · Published 2015-11-16 · Updated 2019-11-21 · CVE-2015-7816

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Piwik versions prior to 2.15.0

Description The issue allows remote attackers to conduct PHP object injection attacks, conduct Server-Side Request Forgery (SSRF) attacks, and execute arbitrary PHP code via a crafted HTTP header. This is due to a problem in the DisplayTopKeywords function in plugins/Referrers/Controller.php.

Recommendations For versions prior to 2.15.0, update to version 2.15.0 or later to resolve the issue.

Exploit

Fix

Related Identifiers

CVE-2015-7816

Affected Products

Piwik

References · 7

• 🔥 http://seclists.org/fulldisclosure/2015/Nov/15 · Exploit
• 🔥 http://packetstormsecurity.com/files/134220/Piwik-2.14.3-PHP-Object-Injection.html · Exploit
• 🔥 http://karmainsecurity.com/KIS-2015-10 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-7816 · Security Note
• https://piwik.org/changelog/piwik-2-15-0 · Vendor Advisory
• http://securityfocus.com/archive/1/536839/100/0/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7816 · Note