CVE-2022-24637

Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '<?php (instead of the intended "<?php sequence) aren't handled by the PHP interpreter.
Configurations

Configuration 1 (hide)

cpe:2.3:a:openwebanalytics:open_web_analytics:*:*:*:*:*:*:*:*

History

21 Nov 2024, 06:50

Type Values Removed Values Added
References () http://packetstormsecurity.com/files/169811/Open-Web-Analytics-1.7.3-Remote-Code-Execution.html - Exploit, Third Party Advisory, VDB Entry () http://packetstormsecurity.com/files/169811/Open-Web-Analytics-1.7.3-Remote-Code-Execution.html - Exploit, Third Party Advisory, VDB Entry
References () http://packetstormsecurity.com/files/171389/Open-Web-Analytics-1.7.3-Remote-Code-Execution.html - () http://packetstormsecurity.com/files/171389/Open-Web-Analytics-1.7.3-Remote-Code-Execution.html -
References () https://devel0pment.de/?p=2494 - Exploit, Mitigation, Patch, Third Party Advisory () https://devel0pment.de/?p=2494 - Exploit, Mitigation, Patch, Third Party Advisory
References () https://github.com/Open-Web-Analytics/Open-Web-Analytics/releases/tag/1.7.4 - Release Notes, Third Party Advisory () https://github.com/Open-Web-Analytics/Open-Web-Analytics/releases/tag/1.7.4 - Release Notes, Third Party Advisory

Information

Published : 2022-03-18 16:15

Updated : 2024-11-21 06:50


NVD link : CVE-2022-24637

Mitre link : CVE-2022-24637

CVE.ORG link : CVE-2022-24637


JSON object : View

Products Affected

openwebanalytics

  • open_web_analytics
CWE
CWE-269

Improper Privilege Management