CVE-2009-1085 - Piwik 0.2.32 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the API key and other sensitive information via a direct request for misc/cron/archive.sh

Back Back to CVE browser

MEDIUM

Piwik 0.2.32 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the API key and other sensitive information via a direct request for misc/cron/archive.sh

Published Mar 25, 2009

5.0

MEDIUM

CVSS 2.0

EPSS 1.21%

Description

Piwik 0.2.32 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the API key and other sensitive information via a direct request for misc/cron/archive.sh.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-264

References (4)

http://dev.piwik.org/trac/ticket/599
x_refsource_CONFIRM
http://marco-ziesing.de/archives/35-Schluesselloch-in-Piwik.html
x_refsource_MISC
http://www.openwall.com/lists/oss-security/2009/03/23/2
mailing-listx_refsource_MLIST
https://euvd.enisa.europa.eu/vulnerability/EUVD-2009-1086
Advisory

Link	Providers	Tags
http://dev.piwik.org/trac/ticket/599		x_refsource_CONFIRM
http://marco-ziesing.de/archives/35-Schluesselloch-in-Piwik.html		x_refsource_MISC
http://www.openwall.com/lists/oss-security/2009/03/23/2		mailing-listx_refsource_MLIST
https://euvd.enisa.europa.eu/vulnerability/EUVD-2009-1086		Advisory