First published: Mon Jan 10 2011(Updated: )
Cookie.php in Piwik before 1.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
Credit: cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
MediaWiki Matomo | <=1.0 | |
MediaWiki Matomo | =0.1 | |
MediaWiki Matomo | =0.1.1 | |
MediaWiki Matomo | =0.1.2 | |
MediaWiki Matomo | =0.1.3 | |
MediaWiki Matomo | =0.1.4 | |
MediaWiki Matomo | =0.1.5 | |
MediaWiki Matomo | =0.1.6 | |
MediaWiki Matomo | =0.1.7 | |
MediaWiki Matomo | =0.1.8 | |
MediaWiki Matomo | =0.1.9 | |
MediaWiki Matomo | =0.1.10 | |
MediaWiki Matomo | =0.2.1 | |
MediaWiki Matomo | =0.2.2 | |
MediaWiki Matomo | =0.2.3 | |
MediaWiki Matomo | =0.2.4 | |
MediaWiki Matomo | =0.2.5 | |
MediaWiki Matomo | =0.2.6 | |
MediaWiki Matomo | =0.2.7 | |
MediaWiki Matomo | =0.2.8 | |
MediaWiki Matomo | =0.2.9 | |
MediaWiki Matomo | =0.2.10 | |
MediaWiki Matomo | =0.2.11 | |
MediaWiki Matomo | =0.2.12 | |
MediaWiki Matomo | =0.2.13 | |
MediaWiki Matomo | =0.2.14 | |
MediaWiki Matomo | =0.2.16 | |
MediaWiki Matomo | =0.2.17 | |
MediaWiki Matomo | =0.2.18 | |
MediaWiki Matomo | =0.2.19 | |
MediaWiki Matomo | =0.2.20 | |
MediaWiki Matomo | =0.2.22 | |
MediaWiki Matomo | =0.2.23 | |
MediaWiki Matomo | =0.2.24 | |
MediaWiki Matomo | =0.2.25 | |
MediaWiki Matomo | =0.2.26 | |
MediaWiki Matomo | =0.2.27 | |
MediaWiki Matomo | =0.2.28 | |
MediaWiki Matomo | =0.2.29 | |
MediaWiki Matomo | =0.2.30 | |
MediaWiki Matomo | =0.2.31 | |
MediaWiki Matomo | =0.2.32 | |
MediaWiki Matomo | =0.2.33 | |
MediaWiki Matomo | =0.2.34 | |
MediaWiki Matomo | =0.4-rc1 | |
MediaWiki Matomo | =0.4-rc2 | |
MediaWiki Matomo | =0.4-rc3 | |
MediaWiki Matomo | =0.4.1-rc1 | |
MediaWiki Matomo | =0.4.4 | |
MediaWiki Matomo | =0.4.5 | |
MediaWiki Matomo | =0.5 | |
MediaWiki Matomo | =0.5.1 | |
MediaWiki Matomo | =0.5.2 | |
MediaWiki Matomo | =0.5.3 | |
MediaWiki Matomo | =0.5.4 | |
MediaWiki Matomo | =0.5.5 | |
MediaWiki Matomo | =0.6 | |
MediaWiki Matomo | =0.6.1 | |
MediaWiki Matomo | =0.6.2 | |
MediaWiki Matomo | =0.6.3 | |
MediaWiki Matomo | =0.6.3-rc1 | |
MediaWiki Matomo | =0.6.3-rc2 | |
MediaWiki Matomo | =0.6.4 | |
MediaWiki Matomo | =0.7 | |
MediaWiki Matomo | =0.8 | |
MediaWiki Matomo | =0.9 | |
MediaWiki Matomo | =0.9.9 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2011-0400 is classified as a medium severity vulnerability due to its potential for session hijacking.
To fix CVE-2011-0400, update to a version of Matomo that is 1.1 or later, where the secure flag is set for session cookies.
CVE-2011-0400 exposes users to session hijacking attacks through the interception of session cookies.
CVE-2011-0400 affects all versions of Matomo prior to 1.1 and specific older versions starting from 0.1.
If an upgrade is not possible, you should ensure that all traffic is served over HTTPS and manually set the secure flag for session cookies.