Piwik Cross Site Request Forgery and Cross Site Scripting Vulnerabilities
BID:52045
Info
Piwik Cross Site Request Forgery and Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 52045 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 16 2012 12:00AM |
| Updated: | Mar 19 2015 09:17AM |
| Credit: | Piotr Duszynski, Sergey Markov, and Mauro Gentile |
| Vulnerable: |
Piwik Piwik 0.9.9 Piwik Piwik 0.6.4 Piwik Piwik 0.6.3 Piwik Piwik 0.6.2 Piwik Piwik 0.6.1 Piwik Piwik 0.5.5 Piwik Piwik 0.5.4 Piwik Piwik 0.5.3 Piwik Piwik 0.5.1 Piwik Piwik 0.4.5 Piwik Piwik 0.4.4 Piwik Piwik 0.4.3 Piwik Piwik 0.4.2 Piwik Piwik 0.4.1 Piwik Piwik 0.2.32 Piwik Piwik 0.2.20 Piwik Piwik 0.2.19 Piwik Piwik 0.2.18 Piwik Piwik 0.2.17 Piwik Piwik 0.2.16 Piwik Piwik 0.2.14 Piwik Piwik 0.2.13 Piwik Piwik 0.2.12 Piwik Piwik 0.2.11 Piwik Piwik 0.2.10 Piwik Piwik 0.2.9 Piwik Piwik 0.2.8 Piwik Piwik 0.2.6 Piwik Piwik 0.2.3 Piwik Piwik 0.1.10 Piwik Piwik 0.1.7 Piwik Piwik 0.1.5 Piwik Piwik 0.1.4 Piwik Piwik 0.1.3 Piwik Piwik 0.1.2 Piwik Piwik 0.1.1 Piwik Piwik 1.6 Piwik Piwik 1.5 Piwik Piwik 1.4 Piwik Piwik 1.3 Piwik Piwik 1.2 Piwik Piwik 1.1 Piwik Piwik 1.0 Piwik Piwik 0.9 Piwik Piwik 0.8 Piwik Piwik 0.7 Piwik Piwik 0.6.3 Rc2 Piwik Piwik 0.6.3 Rc1 Piwik Piwik 0.6 Piwik Piwik 0.5.2 Piwik Piwik 0.5 Piwik Piwik 0.4.1 Rc1 Piwik Piwik 0.4 Rc3 Piwik Piwik 0.4 Rc2 Piwik Piwik 0.4 Rc1 Piwik Piwik 0.4 Piwik Piwik 0.3 Piwik Piwik 0.2.7 Piwik Piwik 0.2.5 Piwik Piwik 0.2.4 Piwik Piwik 0.2.37 Piwik Piwik 0.2.36 Piwik Piwik 0.2.35 Piwik Piwik 0.2.34 Piwik Piwik 0.2.33 Piwik Piwik 0.2.31 Piwik Piwik 0.2.30 Piwik Piwik 0.2.29 Piwik Piwik 0.2.28 Piwik Piwik 0.2.27 Piwik Piwik 0.2.26 Piwik Piwik 0.2.25 Piwik Piwik 0.2.24 Piwik Piwik 0.2.23 Piwik Piwik 0.2.22 Piwik Piwik 0.2.2 Piwik Piwik 0.2.1 Piwik Piwik 0.1.9 Piwik Piwik 0.1.8 Piwik Piwik 0.1.6 Piwik Piwik 0.1 |
| Not Vulnerable: |
Piwik Piwik 1.7 |
Discussion
Piwik Cross Site Request Forgery and Cross Site Scripting Vulnerabilities
Piwik is prone to a cross-site request-forgery vulnerability and a cross-site scripting vulnerability.
An attacker can exploit the cross-site request-forgery issue to perform unauthorized actions in the context of a user's session. This may aid in other attacks.
The attacker can exploit the cross-site scripting issue to execute arbitrary script code in the context of the vulnerable site, potentially allowing the attacker to steal cookie-based authentication credentials. Other attacks are also possible.
Piwik versions prior to 1.7 are vulnerable.
Piwik is prone to a cross-site request-forgery vulnerability and a cross-site scripting vulnerability.
An attacker can exploit the cross-site request-forgery issue to perform unauthorized actions in the context of a user's session. This may aid in other attacks.
The attacker can exploit the cross-site scripting issue to execute arbitrary script code in the context of the vulnerable site, potentially allowing the attacker to steal cookie-based authentication credentials. Other attacks are also possible.
Piwik versions prior to 1.7 are vulnerable.
Exploit / POC
Piwik Cross Site Request Forgery and Cross Site Scripting Vulnerabilities
An attacker must trick an unsuspecting victim into following a malicious URI to exploit these issues.
An attacker must trick an unsuspecting victim into following a malicious URI to exploit these issues.
Solution / Fix
Piwik Cross Site Request Forgery and Cross Site Scripting Vulnerabilities
Solution:
Vendor updates are available. Please see the references for more information.
Solution:
Vendor updates are available. Please see the references for more information.
References
Piwik Cross Site Request Forgery and Cross Site Scripting Vulnerabilities
References:
References:
- Piwik 1.7 (Piwik)
- Piwik Homepage (Piwik)