Unscored severity · published Jan 10, 2011
CVE-2011-0400
Cookie.php in Piwik before 1.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by…
–
CVSS
1.3%
EPSS
No
On KEV
Description
Cookie.php in Piwik before 1.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Matomo · Matomo
through 1.0; 0.1; 0.1.1; 0.1.2; 0.1.3; 0.1.4; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-0400
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-0400
dev.piwik.org
http://dev.piwik.org/trac/ticket/1795
osvdb.org
http://osvdb.org/70382
Patch
http://piwik.org/blog/2011/01/piwik-1-1-2/
www.securityfocus.com
http://www.securityfocus.com/bid/45787
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/64639
More from Matomo
6.1
CVE-2023-6923
Matomo <= 4.15.3 - Reflected Cross-Site Scripting via idsite
6.1
CVE-2013-0195
Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors
6.1
CVE-2013-0194
Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors
6.1
CVE-2013-0193
Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors
4.3
CVE-2019-12215
A full path disclosure vulnerability was discovered in Matomo v3.9.1 where a user can trigger a particular error to discover the full path of Matomo on the disk, because…