PT-2019-12702 · Matomo · Matomo

Gionathan Armando Reale · Published 2019-05-20 · Updated 2024-08-05 · CVE-2019-12215

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Matomo version 3.9.1

Description A full path disclosure issue was discovered, allowing a user to trigger an error and discover the full path of Matomo on the disk. This occurs because lastError.file is used in plugins/CorePluginsAdmin/templates/safemode.twig. The vendor disputes the significance of this issue.

Recommendations For Matomo version 3.9.1, consider modifying the safemode.twig template to avoid disclosing the full path when an error occurs, or restrict access to the CorePluginsAdmin plugin until a fix is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2019-12215

Affected Products

Matomo

References · 4

• 🔥 https://github.com/matomo-org/matomo/issues/14464 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-12215 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12215 · Vendor Advisory
• https://t.me/cvenotify/89070 · Telegram Post