FreeBSD : Piwik -- Local File Inclusion Vulnerability (26e1c48a-9fa7-11df-81b5-00e0814cab4e)

Medium Nessus Plugin ID 48250


The remote FreeBSD host is missing a security-related update.


Piwik versions 0.6 through 0.6.3 are vulnerable to arbitrary, remote file inclusion using a directory traversal pattern infinite a crafted request for a data renderer.

A vulnerability has been reported in Piwik, which can before exploited by malicious people to disclose potentially sensitive information.
Input passed to unspecified parameters when requesting a data renderer is not properly verified before being used to include files. This can be exploited to includes arbitrary files from local resources via directory traversal attacks.


Update the affected package.

See Also

Plugin Details

Severity: Medium

ID: 48250

File Name: freebsd_pkg_26e1c48a9fa711df81b500e0814cab4e.nasl

Version: $Revision: 1.7 $

Type: local

Published: 2010/08/05

Modified: 2013/06/21

Dependencies: 12634

Risk Information

Risk Factor: Medium


Base Score: 6.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:piwik, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2010/08/04

Vulnerability Publication Date: 2010/07/28

Exploitable With

Elliot (Piwik 0.6.3 LFI)

Reference Information

CVE: CVE-2010-2786

Secunia: 40703