CVEvulnerability
CVE-2022-24637
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2022-03-18
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-269
Description
Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '<?php (instead of the intended "<?php sequence) aren't handled by the PHP interpreter.
Affected configurations
• openwebanalytics open web analytics (< 1.7.4)
Related
Weakness · CWE (1)
- CWE-269 Improper Privilege Management weakness
References
- http://packetstormsecurity.com/files/169811/Open-Web-Analytics-1.7.3-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/171389/Open-Web-Analytics-1.7.3-Remote-Code-Execution.html packetstormsecurity.com
- https://devel0pment.de/?p=2494 Exploit, Mitigation, Patch, Third Party Advisory
- https://github.com/Open-Web-Analytics/Open-Web-Analytics/releases/tag/1.7.4 Release Notes, Third Party Advisory
- http://packetstormsecurity.com/files/169811/Open-Web-Analytics-1.7.3-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/171389/Open-Web-Analytics-1.7.3-Remote-Code-Execution.html packetstormsecurity.com
- https://devel0pment.de/?p=2494 Exploit, Mitigation, Patch, Third Party Advisory
- https://github.com/Open-Web-Analytics/Open-Web-Analytics/releases/tag/1.7.4 Release Notes, Third Party Advisory