Piwik Unspecified Cross-site scripting and Unspecified HTML Injection Vulnerabilities
BID:45659
Info
Piwik Unspecified Cross-site scripting and Unspecified HTML Injection Vulnerabilities
| Bugtraq ID: | 45659 |
| Class: | Input Validation Error |
| CVE: |
CVE-2011-0004 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 04 2011 12:00AM |
| Updated: | Mar 19 2015 08:05AM |
| Credit: | SektionEins and Stefan Esser |
| Vulnerable: |
Piwik Piwik 0.9.9 Piwik Piwik 0.6.4 Piwik Piwik 0.6.3 Piwik Piwik 0.6.2 Piwik Piwik 0.6.1 Piwik Piwik 0.5.5 Piwik Piwik 0.5.4 Piwik Piwik 0.5.3 Piwik Piwik 0.5.1 Piwik Piwik 0.4.5 Piwik Piwik 0.4.4 Piwik Piwik 0.4.3 Piwik Piwik 0.4.2 Piwik Piwik 0.4.1 Piwik Piwik 0.2.32 Piwik Piwik 0.2.20 Piwik Piwik 0.2.19 Piwik Piwik 0.2.18 Piwik Piwik 0.2.17 Piwik Piwik 0.2.16 Piwik Piwik 0.2.14 Piwik Piwik 0.2.13 Piwik Piwik 0.2.12 Piwik Piwik 0.2.11 Piwik Piwik 0.2.10 Piwik Piwik 0.2.9 Piwik Piwik 0.2.8 Piwik Piwik 0.2.6 Piwik Piwik 0.2.3 Piwik Piwik 0.1.10 Piwik Piwik 0.1.7 Piwik Piwik 0.1.5 Piwik Piwik 0.1.4 Piwik Piwik 0.1.3 Piwik Piwik 0.1.2 Piwik Piwik 0.1.1 Piwik Piwik 1.0 Piwik Piwik 0.9 Piwik Piwik 0.8 Piwik Piwik 0.7 Piwik Piwik 0.6.3 Rc2 Piwik Piwik 0.6.3 Rc1 Piwik Piwik 0.6 Piwik Piwik 0.5.2 Piwik Piwik 0.5 Piwik Piwik 0.4.1 Rc1 Piwik Piwik 0.4 Rc3 Piwik Piwik 0.4 Rc2 Piwik Piwik 0.4 Rc1 Piwik Piwik 0.4 Piwik Piwik 0.3 Piwik Piwik 0.2.7 Piwik Piwik 0.2.5 Piwik Piwik 0.2.4 Piwik Piwik 0.2.37 Piwik Piwik 0.2.36 Piwik Piwik 0.2.35 Piwik Piwik 0.2.34 Piwik Piwik 0.2.33 Piwik Piwik 0.2.31 Piwik Piwik 0.2.30 Piwik Piwik 0.2.29 Piwik Piwik 0.2.28 Piwik Piwik 0.2.27 Piwik Piwik 0.2.26 Piwik Piwik 0.2.25 Piwik Piwik 0.2.24 Piwik Piwik 0.2.23 Piwik Piwik 0.2.22 Piwik Piwik 0.2.2 Piwik Piwik 0.2.1 Piwik Piwik 0.1.9 Piwik Piwik 0.1.8 Piwik Piwik 0.1.6 Piwik Piwik 0.1 |
| Not Vulnerable: |
Piwik Piwik 1.1 |
Discussion
Piwik Unspecified Cross-site scripting and Unspecified HTML Injection Vulnerabilities
Piwik is prone to an unspecified cross-site scripting and unspecified HTML injection vulnerabilities.
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible
Versions prior to Piwik 1.1 are vulnerable.
Piwik is prone to an unspecified cross-site scripting and unspecified HTML injection vulnerabilities.
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible
Versions prior to Piwik 1.1 are vulnerable.
Exploit / POC
Piwik Unspecified Cross-site scripting and Unspecified HTML Injection Vulnerabilities
Attackers can exploit these issues using browser. To exploit a cross-site scripting issue the attacker needs to entice a user into following a malicious URI.
Attackers can exploit these issues using browser. To exploit a cross-site scripting issue the attacker needs to entice a user into following a malicious URI.
Solution / Fix
Piwik Unspecified Cross-site scripting and Unspecified HTML Injection Vulnerabilities
Solution:
The vendor has released a fix. Please see the references for more information.
Solution:
The vendor has released a fix. Please see the references for more information.
References
Piwik Unspecified Cross-site scripting and Unspecified HTML Injection Vulnerabilities
References:
References:
- Piwik Homepage (Piwik)
- Professional Security Audit for Piwik 1.1 (Piwik)