Unscored severity · published Mar 25, 2009
CVE-2009-1085
Piwik 0.2.32 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the API key and other sensitive…
–
CVSS
1.2%
EPSS
No
On KEV
Description
Piwik 0.2.32 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the API key and other sensitive information via a direct request for misc/cron/archive.sh.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Matomo · Matomo
through 0.2.32; 0.2.25; 0.2.26; 0.2.27; 0.2.28; 0.2.29; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-1085
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-1085
dev.piwik.org
http://dev.piwik.org/trac/ticket/599
marco-ziesing.de
http://marco-ziesing.de/archives/35-Schluesselloch-in-Piwik.html
www.openwall.com
http://www.openwall.com/lists/oss-security/2009/03/23/2
More from Matomo
6.1
CVE-2023-6923
Matomo <= 4.15.3 - Reflected Cross-Site Scripting via idsite
6.1
CVE-2013-0195
Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors
6.1
CVE-2013-0194
Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors
6.1
CVE-2013-0193
Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors
4.3
CVE-2019-12215
A full path disclosure vulnerability was discovered in Matomo v3.9.1 where a user can trigger a particular error to discover the full path of Matomo on the disk, because…