Piwik < 2.16.0 Unspecified XSS

medium Nessus Plugin ID 90537

Language:

Synopsis

A web application hosted on the remote web server is affected by a cross-site scripting vulnerability.

Description

The version of Piwik running on the remote host is prior to 2.16.0.
It is, therefore, affected by an unspecified cross-site scripting (XSS) vulnerability due to a failure to properly validate input before returning it to users. An unauthenticated, remote attacker can exploit this, via a crafted request, to execute arbitrary script code in a user's browser session.

Solution

Upgrade to Piwik version 2.16.0 or later. If necessary, remove any affected versions.

Plugin Details

Severity: Medium

ID: 90537

File Name: piwik_2_16_0.nasl

Version: 1.6

Type: remote

Family: CGI abuses : XSS

Published: 4/15/2016

Updated: 6/5/2024

Configuration: Enable thorough checks

Supported Sensors: Nessus

Enable CGI Scanning: true

Vulnerability Information

CPE: cpe:/a:piwik:piwik

Required KB Items: www/PHP, installed_sw/Piwik

Excluded KB Items: Settings/disable_cgi_scanning

Patch Publication Date: 2/4/2016

Vulnerability Publication Date: 2/4/2016

Detections

Analytics