Improper Privilege Management in Open Web Analytics
Critical severity
GitHub Reviewed
Published
Mar 19, 2022
to the GitHub Advisory Database
•
Updated Mar 17, 2023
Package
Affected versions
< 1.7.4
Patched versions
1.7.4
Description
Published by the National Vulnerability Database
Mar 18, 2022
Published to the GitHub Advisory Database
Mar 19, 2022
Reviewed
Mar 30, 2022
Last updated
Mar 17, 2023
Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '<?php (instead of the intended "<?php sequence) aren't handled by the PHP interpreter.
References