Re: CVE request: Piwik before 1.7

[Henri Salo <henri () nerv fi>]

On Tue, May 08, 2012 at 10:44:46PM -0600, Kurt Seifried wrote:
> On 05/08/2012 03:03 AM, Hanno Böck wrote:
> > Hi,
> >
> > http://piwik.org/blog/2012/02/7775/
> >
> > Information is very rare: "We would like to thank the following
> > security researchers for their responsible disclosure of XSS &
> > click-jacking issues: Piotr Duszynski, Sergey Markov, Mauro
> > Gentile."
> >
> > I'd suggest assigning 3 CVEs with subjects like
> >
> > "Unknown XSS or clickjacking issue identified by Piotr Duszynski" 
> > "Unknown XSS or clickjacking issue identified by Sergey Markov" 
> > "Unknown XSS or clickjacking issue identified by Mauro Gentile"
>
>
> We would like to thank the following security researchers for their
> responsible disclosure of XSS & click-jacking issues: Piotr Duszynski,
> Sergey Markov, Mauro Gentile.
> Thank you for disclosing security issues to the Piwik team, ensuring a
> healthy and safe experience for the whole community!
>
> I can't find anything else. Can you send the code commits that address
> this?
>
>
> - -- 
> Kurt Seifried Red Hat Security Response Team (SRT)
> PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

After long email conversation with the vendor we are not getting any details from them. This 
http://dev.piwik.org/trac/changeset/5804 might be related as Nicob pointed out. Could we still assign CVE-identifiers 
for these three issues?

- Henri Salo