« Back to list

CVE-2009-1085

Status: ModifiedMedium (5)—

Piwik 0.2.32 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the API key and other sensitive information via a direct request for misc/cron/archive.sh.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Matomo — Matomo

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2009-1085",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-03-25T18:30:00.530",
  "references": [
    {
      "url": "http://dev.piwik.org/trac/ticket/599",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://marco-ziesing.de/archives/35-Schluesselloch-in-Piwik.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2009/03/23/2",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://dev.piwik.org/trac/ticket/599",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://marco-ziesing.de/archives/35-Schluesselloch-in-Piwik.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2009/03/23/2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Piwik 0.2.32 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the API key and other sensitive information via a direct request for misc/cron/archive.sh."
    },
    {
      "lang": "es",
      "value": "Piwik v0.2.32 y anterioes almacenan información sensible bajo en directorio raíz Web con control de acceso insuficiente, lo que permite a atacantes remotos conseguir la clave API y otra información sensible a través de una petición directa de  misc/cron/archive.sh."
    }
  ],
  "lastModified": "2026-06-16T23:06:28.333",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:matomo:matomo:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "43A7DB24-9CF1-4F80-AC3B-770416688084",
              "versionEndIncluding": "0.2.32"
            },
            {
              "criteria": "cpe:2.3:a:matomo:matomo:0.2.25:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "262A0DB0-6CE4-41E7-BDC6-18924C76EDCB"
            },
            {
              "criteria": "cpe:2.3:a:matomo:matomo:0.2.26:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D3F37F31-2288-4B86-9EEB-38EE8B1979C2"
            },
            {
              "criteria": "cpe:2.3:a:matomo:matomo:0.2.27:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "74DBC09F-4B09-490B-8367-93B3257F9DBF"
            },
            {
              "criteria": "cpe:2.3:a:matomo:matomo:0.2.28:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0384553E-FEEB-4AE4-B1F1-1EC99BE07BD9"
            },
            {
              "criteria": "cpe:2.3:a:matomo:matomo:0.2.29:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E64C21FE-BCA5-4830-AA85-5959CBE3800D"
            },
            {
              "criteria": "cpe:2.3:a:matomo:matomo:0.2.30:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF976D83-866E-416D-A21C-2BF2A8F95462"
            },
            {
              "criteria": "cpe:2.3:a:matomo:matomo:0.2.31:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1E9EB7C0-C645-4E1A-A7CD-87325BBA81E5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}