~ / search / GHSA-pr9q-v585-qv2w

GHSA-pr9q-v585-qv2w

Improper Privilege Management in Open Web Analytics

Source: GitHub Advisory Database (reviewed) Critical CVE-2022-24637

Packages

EcosystemPackageAffectedFixed in
Packagist open-web-analytics/open-web-analytics < 1.7.4 1.7.4

Details

As written in the advisory (Markdown source, shown as plain text).

Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '<?php (instead of the intended "<?php sequence) aren't handled by the PHP interpreter.

References

External links from the advisory. They lead to third-party sites.