Re: Piwik <= 0.4.5 Cookie Unserialize() Vulnerability

[Josh Bressers <bressers () redhat com>]

Please use CVE-2009-4137 for this.

Sadly I can't find other references. Even the Piwik changelog is a bit slient
on this.

Thanks.

-- 
    JB


----- "Eren Türkay" <eren () pardus org tr> wrote:

> Hello,
>
> Piwik is an open source web analytics software program used by various
>
> sites.
>
> Stefan Esser found a vulnerability in Piwik, which can allow arbitrary
> files 
> to be written into writable locations on the webserver. He says, it is
> also 
> possible to execute arbitrary PHP code directly in newer versions of
> Piwik.
>
> The original advisory is here: 
> http://www.suspekt.org/2009/12/09/advisory-032009-piwik-cookie-
> unserialize-vulnerability/
>
> I think, it is worth assigning a CVE.
>
> Regards,
> Eren

-- 
    JB