Piwik Unspecified Cross Site Scripting Vulnerability
BID:58392
Info
Piwik Unspecified Cross Site Scripting Vulnerability
| Bugtraq ID: | 58392 |
| Class: | Input Validation Error |
| CVE: |
CVE-2013-1844 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 08 2013 12:00AM |
| Updated: | Mar 19 2015 09:36AM |
| Credit: | Leone Pontorieri |
| Vulnerable: |
Piwik Piwik 0.9.9 Piwik Piwik 0.6.4 Piwik Piwik 0.6.3 Piwik Piwik 0.6.2 Piwik Piwik 0.6.1 Piwik Piwik 0.5.5 Piwik Piwik 0.5.4 Piwik Piwik 0.5.3 Piwik Piwik 0.5.1 Piwik Piwik 0.4.5 Piwik Piwik 0.4.4 Piwik Piwik 0.4.3 Piwik Piwik 0.4.2 Piwik Piwik 0.4.1 Piwik Piwik 0.2.32 Piwik Piwik 0.2.20 Piwik Piwik 0.2.19 Piwik Piwik 0.2.18 Piwik Piwik 0.2.17 Piwik Piwik 0.2.16 Piwik Piwik 0.2.14 Piwik Piwik 0.2.13 Piwik Piwik 0.2.12 Piwik Piwik 0.2.11 Piwik Piwik 0.2.10 Piwik Piwik 0.2.9 Piwik Piwik 0.2.8 Piwik Piwik 0.2.6 Piwik Piwik 0.2.3 Piwik Piwik 0.1.10 Piwik Piwik 0.1.7 Piwik Piwik 0.1.5 Piwik Piwik 0.1.4 Piwik Piwik 0.1.3 Piwik Piwik 0.1.2 Piwik Piwik 0.1.1 Piwik Piwik 1.0 Piwik Piwik 0.9 Piwik Piwik 0.8 Piwik Piwik 0.7 Piwik Piwik 0.6.3 Rc2 Piwik Piwik 0.6.3 Rc1 Piwik Piwik 0.6 Piwik Piwik 0.5.2 Piwik Piwik 0.5 Piwik Piwik 0.4.1 Rc1 Piwik Piwik 0.4 Rc3 Piwik Piwik 0.4 Rc2 Piwik Piwik 0.4 Rc1 Piwik Piwik 0.4 Piwik Piwik 0.3 Piwik Piwik 0.2.7 Piwik Piwik 0.2.5 Piwik Piwik 0.2.4 Piwik Piwik 0.2.37 Piwik Piwik 0.2.36 Piwik Piwik 0.2.35 Piwik Piwik 0.2.34 Piwik Piwik 0.2.33 Piwik Piwik 0.2.31 Piwik Piwik 0.2.30 Piwik Piwik 0.2.29 Piwik Piwik 0.2.28 Piwik Piwik 0.2.27 Piwik Piwik 0.2.26 Piwik Piwik 0.2.25 Piwik Piwik 0.2.24 Piwik Piwik 0.2.23 Piwik Piwik 0.2.22 Piwik Piwik 0.2.2 Piwik Piwik 0.2.1 Piwik Piwik 0.1.9 Piwik Piwik 0.1.8 Piwik Piwik 0.1.6 Piwik Piwik 0.1 |
| Not Vulnerable: | |
Discussion
Piwik Unspecified Cross Site Scripting Vulnerability
Piwik is prone to an unspecified cross-site scripting vulnerability because it fails to sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
Versions prior to Piwik 1.11 are vulnerable.
Piwik is prone to an unspecified cross-site scripting vulnerability because it fails to sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
Versions prior to Piwik 1.11 are vulnerable.
Exploit / POC
Piwik Unspecified Cross Site Scripting Vulnerability
An attacker can exploit the issue by enticing an unsuspecting user to visit a specially crafted URL.
An attacker can exploit the issue by enticing an unsuspecting user to visit a specially crafted URL.
Solution / Fix
Piwik Unspecified Cross Site Scripting Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.