Home page logo
/

oss-sec logo oss-sec mailing list archives

Re: CVE request: piwik before 1.10
From: Kurt Seifried <kseifried () redhat com>
Date: Thu, 17 Jan 2013 13:27:59 -0700

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 01/17/2013 02:18 AM, Hanno Böck wrote:
Hi,

See here: http://piwik.org/blog/2013/01/piwik-1-10/

"Security: We would like to thank the Security Researchers Mateusz 
Goik,  Paweł Hałdrzyński and Artur Czyż, for their responsible 
disclosure. They have all reported XSS vulnerabilities (which
we’ve fixed) as part of our Security Bug Bounty Program. Thank you
to them for making Piwik more secure!"

Security focus lists it, but it calls it just "Multiple
Unspecified Cross Site Scripting Vulnerabilities".

No further details. And as piwik devs already statet here last
year, they like security by obscurity so I don't think asking them
will help.

Please assign CVE. (I think one for all XSS issues fixed in 1.10
is enough).

cu,

As per CVE merge/split, 3 different researchers = 3 different CVEs. I
can't find any link between them (e.g.  they don't work for the same
company and reported them as a group), so the CVE's are:

Piwiki 1.10 XSS Mateusz Goik use CVE-2013-0193
Piwiki 1.10 XSS Paweł Hałdrzyński use CVE-2013-0194
Piwiki 1.10 XSS Artur Czyż use CVE-2013-0195


- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQIcBAEBAgAGBQJQ+F7PAAoJEBYNRVNeJnmTRZwP/02o64X8u/k87JQAlfL7sbjH
CKdLYpLRXv++vpZSgaiMTPpurqCCA9vXy3okAPnc33wg7F6sq9z3iTMuHFUX9g4n
QUOPn/EigwUDYZbAEbUpZInK3WcM1fkXEoglZXsUzDfUnp3OMsCPiO3L+B5hzqaW
ruZi8Ct673eaIl09KyB0OGDB8uNw1IFvXhRafEUM+jC6gvIkgp/xXoQQ+XYBN/Kn
O5Gn4AdXlouGcJO1p82Y/WU3JBToJihXzATIp9lddxni3Si8ZGQzovgfohtRE46H
3PEIhbxe6pIddkuOCJfOfB7sUyFfJCjMtziKNmOaB1U9QRxsqA8TEy1doyDsrS82
oJH2WQgavpbEAsgtC5Lpih9nFPeONgbI4pMBVyCc4Z5FVU636mUz4UfGqx9vM7Ba
Xq4FaM8h26qXiSSZgYX7ok7ddo7vmxqo4PmuC2iaMrx9cUxNJWcV7vJXNAjLp2ff
feDdXV0cmMOuUTSAIBiPxWOo7kV7e6Ci/ifFfUv1lGXbyy99DXz4GWVCwp0k8ykv
LnCUMfexgL4gZduY1k/Hs/h4VHbEEYdOrtWblaNWLJLUsEo6ZCGoayaLoDsmS9fQ
CEOsrNdhfh0kllpZULFljPQO+lJihM6aiv9HgBWHrBTGtCJKbwDQ7hp4MI7HsrV7
/Q2p/TO+M/xsrogH4Hfs
=7f5c
-----END PGP SIGNATURE-----


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]