CVE-2011-0400: Medium severity mediawiki matomo vulnerability

Q: What is the severity of CVE-2011-0400?

CVE-2011-0400 is classified as a medium severity vulnerability due to its potential for session hijacking.

Q: How do I fix CVE-2011-0400?

To fix CVE-2011-0400, update to a version of Matomo that is 1.1 or later, where the secure flag is set for session cookies.

Q: What types of attacks does CVE-2011-0400 expose users to?

CVE-2011-0400 exposes users to session hijacking attacks through the interception of session cookies.

Q: Which versions of Matomo are affected by CVE-2011-0400?

CVE-2011-0400 affects all versions of Matomo prior to 1.1 and specific older versions starting from 0.1.

Q: What should I do if I cannot upgrade from an affected version of Matomo regarding CVE-2011-0400?

If an upgrade is not possible, you should ensure that all traffic is served over HTTPS and manually set the secure flag for session cookies.

Published Jan 10, 2011

Updated

Cookie.php in Piwik before 1.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

Affected Software

67 affected components

Matomo Matomo<=1.0

Matomo Matomo=0.1

Matomo Matomo=0.1.1

Matomo Matomo=0.1.2

Matomo Matomo=0.1.3

Matomo Matomo=0.1.4

Matomo Matomo=0.1.5

Matomo Matomo=0.1.6

Matomo Matomo=0.1.7

Matomo Matomo=0.1.8

Matomo Matomo=0.1.9

Matomo Matomo=0.1.10

Matomo Matomo=0.2.1

Matomo Matomo=0.2.2

Matomo Matomo=0.2.3

Matomo Matomo=0.2.4

Matomo Matomo=0.2.5

Matomo Matomo=0.2.6

Matomo Matomo=0.2.7

Matomo Matomo=0.2.8

Matomo Matomo=0.2.9

Matomo Matomo=0.2.10

Matomo Matomo=0.2.11

Matomo Matomo=0.2.12

Matomo Matomo=0.2.13

Matomo Matomo=0.2.14

Matomo Matomo=0.2.16

Matomo Matomo=0.2.17

Matomo Matomo=0.2.18

Matomo Matomo=0.2.19

Matomo Matomo=0.2.20

Matomo Matomo=0.2.22

Matomo Matomo=0.2.23

Matomo Matomo=0.2.24

Matomo Matomo=0.2.25

Matomo Matomo=0.2.26

Matomo Matomo=0.2.27

Matomo Matomo=0.2.28

Matomo Matomo=0.2.29

Matomo Matomo=0.2.30

Matomo Matomo=0.2.31

Matomo Matomo=0.2.32

Matomo Matomo=0.2.33

Matomo Matomo=0.2.34

Matomo Matomo=0.4-rc1

Matomo Matomo=0.4-rc2

Matomo Matomo=0.4-rc3

Matomo Matomo=0.4.1-rc1

Matomo Matomo=0.4.4

Matomo Matomo=0.4.5

Matomo Matomo=0.5

Matomo Matomo=0.5.1

Matomo Matomo=0.5.2

Matomo Matomo=0.5.3

Matomo Matomo=0.5.4

Matomo Matomo=0.5.5

Matomo Matomo=0.6

Matomo Matomo=0.6.1

Matomo Matomo=0.6.2

Matomo Matomo=0.6.3

Matomo Matomo=0.6.3-rc1

Matomo Matomo=0.6.3-rc2

Matomo Matomo=0.6.4

Matomo Matomo=0.7

Matomo Matomo=0.8

Matomo Matomo=0.9

Matomo Matomo=0.9.9

Remediation

Patch Available

http://piwik.org/blog/2011/01/piwik-1-1-2/

Event History

Jan 10, 2011

CVE Published

via MITRE·07:18 PM

Data Sourced

via MITRE·07:18 PM

Description

Frequently Asked Questions

What is the severity of CVE-2011-0400?

CVE-2011-0400 is classified as a medium severity vulnerability due to its potential for session hijacking.

How do I fix CVE-2011-0400?

To fix CVE-2011-0400, update to a version of Matomo that is 1.1 or later, where the secure flag is set for session cookies.

What types of attacks does CVE-2011-0400 expose users to?