CVE-2009-4137: Input Validation
The loadContentFromCookie function in core/Cookie.php in Piwik before 0.5 does not validate strings obtained from cookies before calling the unserialize function, which allows remote attackers to execute arbitrary code or upload arbitrary files via vectors related to the destruct function in the PiwikConfig class; php://filter URIs; the destruct functions in Zend Framework, as demonstrated by the ZendLog destructor; the shutdown functions in Zend Framework, as demonstrated by the ZendLogWriterMail class; the render function in the PiwikView class; Smarty templates; and the eval function in Smarty.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-4137?
CVE-2009-4137 has a high severity rating as it allows remote code execution due to improper cookie validation.
How do I fix CVE-2009-4137?
To fix CVE-2009-4137, upgrade to Matomo version 0.5 or later, where the vulnerability has been addressed.
Which versions are affected by CVE-2009-4137?
CVE-2009-4137 affects Matomo versions 0.2.25 through 0.2.32.
What impacts does CVE-2009-4137 have?
CVE-2009-4137 can lead to arbitrary code execution or file uploads, compromising the security of the application.
Who can exploit CVE-2009-4137?
CVE-2009-4137 can be exploited by remote attackers through crafted cookie strings.