Piwik < 2.16.0 Unspecified XSS

medium Nessus Plugin ID 90537

Synopsis

A web application hosted on the remote web server is affected by a cross-site scripting vulnerability.

Description

The version of Piwik running on the remote host is prior to 2.16.0.
It is, therefore, affected by an unspecified cross-site scripting (XSS) vulnerability due to a failure to properly validate input before returning it to users. An unauthenticated, remote attacker can exploit this, via a crafted request, to execute arbitrary script code in a user's browser session.

Solution

Upgrade to Piwik version 2.16.0 or later. If necessary, remove any affected versions.

See Also

http://piwik.org/changelog/piwik-2-16-0/

Plugin Details

Severity: Medium

ID: 90537

File Name: piwik_2_16_0.nasl

Version: 1.5

Type: remote

Published: 4/15/2016

Updated: 4/11/2022

Configuration: Enable thorough checks

Risk Information

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.7

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Temporal Vector: E:H/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:piwik:piwik

Required KB Items: installed_sw/Piwik, www/PHP

Patch Publication Date: 2/4/2016

Vulnerability Publication Date: 2/4/2016