PT-2023-10626 · Unknown · Daschtour Matomo-Mediawiki-Extension

Published 2023-02-05 · Updated 2024-05-17 · CVE-2017-20175

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions DaSchTour matomo-mediawiki-extension versions up to 2.4.2

Description A vulnerability has been found in the DaSchTour matomo-mediawiki-extension, affecting an unknown part of the file Piwik.hooks.php of the component Username Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The complexity of an attack is rather high, and the exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.

Recommendations Upgrading to version 2.4.3 is able to address this issue. It is recommended to upgrade the affected component. As a temporary workaround, consider restricting access to the vulnerable component Username Handler until the patch is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-20175

GHSA-HC67-V29C-7G78

Affected Products

Daschtour Matomo-Mediawiki-Extension

References · 11

• 🔥 https://github.com/DaSchTour/matomo-mediawiki-extension/pull/17 · Exploit
• https://github.com/DaSchTour/matomo-mediawiki-extension/commit/681324e4f518a8af4bd1f93867074c728eb9923d · Patch
• https://github.com/DaSchTour/matomo-mediawiki-extension/releases/tag/v2.4.3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2017-20175 · Security Note
• https://osv.dev/vulnerability/CVE-2017-20175 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hc67-v29c-7g78 · Vendor Advisory
• https://github.com/DaSchTour/matomo-mediawiki-extension · Note
• https://vuldb.com/?ctiid.220203 · Note
• https://t.me/cibsecurity/57525 · Telegram Post
• https://t.me/cvenotify/43659 · Telegram Post
• https://vuldb.com/?id.220203 · Note