CVE-2010-1453: XSS

Published May 7, 2010

Updated

Cross-site scripting (XSS) vulnerability in the Login form in Piwik 0.1.6 through 0.5.5 allows remote attackers to inject arbitrary web script or HTML via the formurl parameter.

Affected Software

51 affected components

Piwik Piwik=0.5.5-rc2

Piwik Piwik=0.5.5-rc1

Matomo Matomo=0.1.6

Matomo Matomo=0.1.7

Matomo Matomo=0.1.8

Matomo Matomo=0.1.9

Matomo Matomo=0.1.10

Matomo Matomo=0.2.1

Matomo Matomo=0.2.2

Matomo Matomo=0.2.3

Matomo Matomo=0.2.4

Matomo Matomo=0.2.5

Matomo Matomo=0.2.6

Matomo Matomo=0.2.7

Matomo Matomo=0.2.8

Matomo Matomo=0.2.9

Matomo Matomo=0.2.10

Matomo Matomo=0.2.11

Matomo Matomo=0.2.12

Matomo Matomo=0.2.13

Matomo Matomo=0.2.14

Matomo Matomo=0.2.16

Matomo Matomo=0.2.17

Matomo Matomo=0.2.18

Matomo Matomo=0.2.19

Matomo Matomo=0.2.20

Matomo Matomo=0.2.22

Matomo Matomo=0.2.23

Matomo Matomo=0.2.24

Matomo Matomo=0.2.25

Matomo Matomo=0.2.26

Matomo Matomo=0.2.27

Matomo Matomo=0.2.28

Matomo Matomo=0.2.29

Matomo Matomo=0.2.30

Matomo Matomo=0.2.31

Matomo Matomo=0.2.32

Matomo Matomo=0.2.33

Matomo Matomo=0.2.34

Matomo Matomo=0.4-rc1

Matomo Matomo=0.4-rc2

Matomo Matomo=0.4-rc3

Matomo Matomo=0.4.1-rc1

Matomo Matomo=0.4.4

Matomo Matomo=0.4.5

Matomo Matomo=0.5

Matomo Matomo=0.5.1

Matomo Matomo=0.5.2

Matomo Matomo=0.5.3

Matomo Matomo=0.5.4

Matomo Matomo=0.5.5

Remediation

Patch Available

http://www.vupen.com/english/advisories/2010/1079

Event History

May 7, 2010

CVE Published

via MITRE·05:43 PM

Data Sourced

via MITRE·05:43 PM

Description

Data Sourced

via NVD·06:24 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2010-1453?

CVE-2010-1453 has a moderate severity rating due to its potential for cross-site scripting (XSS) attacks.

How do I fix CVE-2010-1453?

To fix CVE-2010-1453, update Piwik to version 0.6 or later, which addresses the XSS vulnerability.

What versions are affected by CVE-2010-1453?

CVE-2010-1453 affects Piwik versions 0.1.6 through 0.5.5.

What impact does CVE-2010-1453 allow?

CVE-2010-1453 allows remote attackers to inject arbitrary web script or HTML via the form_url parameter.

Is user input safe from XSS in versions above 0.5.5 of Piwik?

Yes, versions above 0.5.5 of Piwik are expected to mitigate the XSS risk introduced by CVE-2010-1453.