GitHub Advisoryadvisory · Packagist

GHSA-pr9q-v585-qv2w Improper Privilege Management in Open Web Analytics

CRITICAL Published 2022-03-19 Modified 2022-03-30 Official page ↗
Aliases
CVE-2022-24637
Ecosystem
Packagist
Packages
open-web-analytics/open-web-analytics
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-269
Reviewed
2022-03-30

Affected packages

• Packagist open-web-analytics/open-web-analytics: < 1.7.4 → fixed in 1.7.4

Description

Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '<?php (instead of the intended "<?php sequence) aren't handled by the PHP interpreter.

Related

Alias · CVE (1)

  • CVE-2022-24637 Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to… vulnerability

Weakness · CWE (1)

  • CWE-269 Improper Privilege Management weakness

References