FreeBSD : Piwik -- Local File Inclusion Vulnerability (26e1c48a-9fa7-11df-81b5-00e0814cab4e)

medium Nessus Plugin ID 48250

Language:

Synopsis

The remote FreeBSD host is missing a security-related update.

Description

Piwik versions 0.6 through 0.6.3 are vulnerable to arbitrary, remote file inclusion using a directory traversal pattern infinite a crafted request for a data renderer.

A vulnerability has been reported in Piwik, which can before exploited by malicious people to disclose potentially sensitive information.
Input passed to unspecified parameters when requesting a data renderer is not properly verified before being used to include files. This can be exploited to includes arbitrary files from local resources via directory traversal attacks.

Solution

Update the affected package.

Plugin Details

Severity: Medium

ID: 48250

File Name: freebsd_pkg_26e1c48a9fa711df81b500e0814cab4e.nasl

Version: 1.12

Type: local

Family: FreeBSD Local Security Checks

Published: 8/5/2010

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.3

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:piwik, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 8/4/2010

Vulnerability Publication Date: 7/28/2010

Exploitable With

Elliot (Piwik 0.6.3 LFI)

Reference Information

CVE: CVE-2010-2786

Secunia: 40703

Detections

Analytics