Detections
Analytics

Piwik < 2.16.1-rc1 Multiple Vulnerabilities

critical Nessus Plugin ID 90538

Language:

Synopsis

A web application hosted on the remote web server is affected by multiple vulnerabilities.

Description

The version of Piwik running on the remote web host is prior to version 2.16.1-rc1. It is, therefore, affected by multiple vulnerabilities :

 - An unspecified flaw exists that may allow an attacker to have a critical impact. No further details are available.

 - Multiple unspecified cross-site scripting (XSS) vulnerabilities exist due to a failure to properly validate input before returning it to users. An unauthenticated, remote attacker can exploit these, via a crafted request, to execute arbitrary script code in a user's browser session.

Solution

Upgrade to Piwik version 2.16.1-rc1 or later. If necessary, remove any affected versions.

See Also

http://piwik.org/changelog/piwik-2-16-1/

Plugin Details

Severity: Critical

ID: 90538

File Name: piwik_2_16_1.nasl

Version: 1.8

Type: remote

Family: CGI abuses

Published: 4/15/2016

Updated: 6/5/2024

Configuration: Enable thorough checks (optional)

Supported Sensors: Nessus

Enable CGI Scanning: true

Vulnerability Information

CPE: cpe:/a:piwik:piwik

Required KB Items: www/PHP, installed_sw/Piwik

Excluded KB Items: Settings/disable_cgi_scanning

Patch Publication Date: 4/1/2016

Vulnerability Publication Date: 4/1/2016