Lucene search

[email protected]CVE-2011-0398

HistoryJan 10, 2011 - 8:00 p.m.

CVE-2011-0398

2011-01-1020:00:17

CWE-264

[email protected]

web.nvd.nist.gov

piwik

cve-2011-0398

security vulnerability

geolocation

logging

ip address spoofing

nvd

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

6.9 Medium

AI Score

Confidence

Low

0.006 Low

EPSS

Percentile

78.0%

JSON

The Piwik_Common::getIP function in Piwik before 1.1 does not properly determine the client IP address, which allows remote attackers to bypass intended geolocation and logging functionality via (1) use of a private (aka RFC 1918) address behind a proxy server or (2) spoofing of the X-Forwarded-For HTTP header.

Affected configurations

NVD

Node

matomomatomoRange≤1.0

matomomatomoMatch0.1

matomomatomoMatch0.1.1

matomomatomoMatch0.1.2

matomomatomoMatch0.1.3

matomomatomoMatch0.1.4

matomomatomoMatch0.1.5

matomomatomoMatch0.1.6

matomomatomoMatch0.1.7

matomomatomoMatch0.1.8

matomomatomoMatch0.1.9

matomomatomoMatch0.1.10

matomomatomoMatch0.2.1

matomomatomoMatch0.2.2

matomomatomoMatch0.2.3

matomomatomoMatch0.2.4

matomomatomoMatch0.2.5

matomomatomoMatch0.2.6

matomomatomoMatch0.2.7

matomomatomoMatch0.2.8

matomomatomoMatch0.2.9

matomomatomoMatch0.2.10

matomomatomoMatch0.2.11

matomomatomoMatch0.2.12

matomomatomoMatch0.2.13

matomomatomoMatch0.2.14

matomomatomoMatch0.2.16

matomomatomoMatch0.2.17

matomomatomoMatch0.2.18

matomomatomoMatch0.2.19

matomomatomoMatch0.2.20

matomomatomoMatch0.2.22

matomomatomoMatch0.2.23

matomomatomoMatch0.2.24

matomomatomoMatch0.2.25

matomomatomoMatch0.2.26

matomomatomoMatch0.2.27

matomomatomoMatch0.2.28

matomomatomoMatch0.2.29

matomomatomoMatch0.2.30

matomomatomoMatch0.2.31

matomomatomoMatch0.2.32

matomomatomoMatch0.2.33

matomomatomoMatch0.2.34

matomomatomoMatch0.4rc1

matomomatomoMatch0.4rc2

matomomatomoMatch0.4rc3

matomomatomoMatch0.4.1rc1

matomomatomoMatch0.4.4

matomomatomoMatch0.4.5

matomomatomoMatch0.5

matomomatomoMatch0.5.1

matomomatomoMatch0.5.2

matomomatomoMatch0.5.3

matomomatomoMatch0.5.4

matomomatomoMatch0.5.5

matomomatomoMatch0.6

matomomatomoMatch0.6.1

matomomatomoMatch0.6.2

matomomatomoMatch0.6.3

matomomatomoMatch0.6.3rc1

matomomatomoMatch0.6.3rc2

matomomatomoMatch0.6.4

matomomatomoMatch0.7

matomomatomoMatch0.8

matomomatomoMatch0.9

matomomatomoMatch0.9.9

CPENameOperatorVersion
matomo:matomomatomole1.0
matomo:matomomatomoeq0.1
matomo:matomomatomoeq0.1.1
matomo:matomomatomoeq0.1.2
matomo:matomomatomoeq0.1.3
matomo:matomomatomoeq0.1.4
matomo:matomomatomoeq0.1.5
matomo:matomomatomoeq0.1.6
matomo:matomomatomoeq0.1.7
matomo:matomomatomoeq0.1.8

CPE	Name	Operator	Version
matomo:matomo	matomo	le	1.0
matomo:matomo	matomo	eq	0.1
matomo:matomo	matomo	eq	0.1.1
matomo:matomo	matomo	eq	0.1.2
matomo:matomo	matomo	eq	0.1.3
matomo:matomo	matomo	eq	0.1.4
matomo:matomo	matomo	eq	0.1.5
matomo:matomo	matomo	eq	0.1.6
matomo:matomo	matomo	eq	0.1.7
matomo:matomo	matomo	eq	0.1.8

Rows per page:

1-10 of 631

References

dev.piwik.org/trac/ticket/567

osvdb.org/70384

piwik.org/blog/2011/01/piwik-1-1-2/

www.securityfocus.com/bid/45787

exchange.xforce.ibmcloud.com/vulnerabilities/64641

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

6.9 Medium

AI Score

Confidence

Low

0.006 Low

EPSS

Percentile

78.0%

JSON

Related for CVE-2011-0398

prion1 nvd1 cvelist1