CVE-2009-1085

Published: Mar 25, 2009Modified: Apr 23, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Piwik 0.2.32 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the API key and other sensitive information via a direct request for misc/cron/archive.sh.

Affected (8)

Products: Matomo: Matomo

Matomo

1 product

Matomo

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Matomo Matomo	Up to 0.2.32
Matomo Matomo	Version 0.2.25
Matomo Matomo	Version 0.2.26
Matomo Matomo	Version 0.2.27
Matomo Matomo	Version 0.2.28
Matomo Matomo	Version 0.2.29
Matomo Matomo	Version 0.2.30
Matomo Matomo	Version 0.2.31

Related CWEs

CWE-264

References (6)

http://dev.piwik.org/trac/ticket/599

Source: cve@mitre.org

http://marco-ziesing.de/archives/35-Schluesselloch-in-Piwik.html

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2009/03/23/2

Source: cve@mitre.org

http://dev.piwik.org/trac/ticket/599

Source: af854a3a-2127-422b-91ae-364da2661108

http://marco-ziesing.de/archives/35-Schluesselloch-in-Piwik.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2009/03/23/2

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.