Vulnerabilities affecting this package (0)
| Vulnerability |
Summary |
Fixed by |
|
This package is not known to be affected by vulnerabilities.
|
Vulnerabilities fixed by this package (1)
| Vulnerability |
Summary |
Aliases |
|
VCID-rsw1-fxn2-6fa8
|
PHP Object Injection Vulnerability
There's a PHP Object Injection vulnerability that can be triggered through the `saveLayout()` method defined into the `/plugins/Dashboard/Controller.php` script. Since Piwik is not using "utf8mb4" collations for its database, this can be exploited in combination with a MySQL UTF8 truncation issue in order to corrupt the session array, allowing unauthenticated attackers to inject arbitrary PHP objects into the application scope and carry out Server-Side Request Forgery (SSRF) attacks, delete arbitrary files, execute arbitrary PHP code, and possibly other attacks.
|
GMS-2016-85
|