« Volver al listado

CVE-2009-1085

Estado: ModificadaMedia (5)—

Piwik 0.2.32 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the API key and other sensitive information via a direct request for misc/cron/archive.sh.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Matomo — Matomo

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2009-1085",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-03-25T18:30:00.530",
  "references": [
    {
      "url": "http://dev.piwik.org/trac/ticket/599",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://marco-ziesing.de/archives/35-Schluesselloch-in-Piwik.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2009/03/23/2",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://dev.piwik.org/trac/ticket/599",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://marco-ziesing.de/archives/35-Schluesselloch-in-Piwik.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2009/03/23/2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Piwik 0.2.32 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the API key and other sensitive information via a direct request for misc/cron/archive.sh."
    },
    {
      "lang": "es",
      "value": "Piwik v0.2.32 y anterioes almacenan información sensible bajo en directorio raíz Web con control de acceso insuficiente, lo que permite a atacantes remotos conseguir la clave API y otra información sensible a través de una petición directa de  misc/cron/archive.sh."
    }
  ],
  "lastModified": "2026-06-16T23:06:28.333",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:matomo:matomo:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "43A7DB24-9CF1-4F80-AC3B-770416688084",
              "versionEndIncluding": "0.2.32"
            },
            {
              "criteria": "cpe:2.3:a:matomo:matomo:0.2.25:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "262A0DB0-6CE4-41E7-BDC6-18924C76EDCB"
            },
            {
              "criteria": "cpe:2.3:a:matomo:matomo:0.2.26:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D3F37F31-2288-4B86-9EEB-38EE8B1979C2"
            },
            {
              "criteria": "cpe:2.3:a:matomo:matomo:0.2.27:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "74DBC09F-4B09-490B-8367-93B3257F9DBF"
            },
            {
              "criteria": "cpe:2.3:a:matomo:matomo:0.2.28:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0384553E-FEEB-4AE4-B1F1-1EC99BE07BD9"
            },
            {
              "criteria": "cpe:2.3:a:matomo:matomo:0.2.29:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E64C21FE-BCA5-4830-AA85-5959CBE3800D"
            },
            {
              "criteria": "cpe:2.3:a:matomo:matomo:0.2.30:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF976D83-866E-416D-A21C-2BF2A8F95462"
            },
            {
              "criteria": "cpe:2.3:a:matomo:matomo:0.2.31:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1E9EB7C0-C645-4E1A-A7CD-87325BBA81E5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}