Open Web Analytics
Monthly
Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site data disclosure in Open Web Analytics before 1.14.1 lets an authenticated user holding the view_reports capability on one site read another site's clickstream visit history, transaction and order records, and Domstream session recordings on the same installation. The reports REST controller and the Domstream player keyed lookups on the caller-supplied session_id, transactionId/order_id or recording guid without also constraining the query to the siteId the capability was checked against, so a user authorized for site A can pair their own siteId with a victim site's record identifier and receive that site's IP addresses, user agents and order data. No public exploit has been identified at time of analysis and there is no KEV listing; exploitation requires a valid account, a multi-site deployment, and knowledge of a target record identifier, so single-site instances are not exposed.
Remote manipulation of Open Web Analytics through 1.8.1 queue bookkeeping is possible through the Remote Event Queue endpoint when event forwarding is enabled, allowing an unauthenticated network attacker to collide with queue-item primary keys, set far-future delivery timestamps, or preload retry counters. The broader CWE-502 object-injection primitive is not reachable solely by an unauthenticated HTTP caller because the vendor patch confirms HTTP input cannot name a class for unserialize; full deserialization exploitation requires an attacker who can already write to the owa_queue_item table or the queue log file, such as via SQL injection, stolen database credentials, or a restored/tampered table. No public exploit identified at time of analysis; vendor-released patch is version 1.8.2.
Cross-site scripting (XSS) vulnerability in the login page in Open Web Analytics (OWA) before 1.5.6 allows remote attackers to inject arbitrary web script or HTML via the owa_user_id parameter to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
SQL injection vulnerability in the password reset page in Open Web Analytics (OWA) before 1.5.5 allows remote attackers to execute arbitrary SQL commands via the owa_email_address parameter in a. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site data disclosure in Open Web Analytics before 1.14.1 lets an authenticated user holding the view_reports capability on one site read another site's clickstream visit history, transaction and order records, and Domstream session recordings on the same installation. The reports REST controller and the Domstream player keyed lookups on the caller-supplied session_id, transactionId/order_id or recording guid without also constraining the query to the siteId the capability was checked against, so a user authorized for site A can pair their own siteId with a victim site's record identifier and receive that site's IP addresses, user agents and order data. No public exploit has been identified at time of analysis and there is no KEV listing; exploitation requires a valid account, a multi-site deployment, and knowledge of a target record identifier, so single-site instances are not exposed.
Remote manipulation of Open Web Analytics through 1.8.1 queue bookkeeping is possible through the Remote Event Queue endpoint when event forwarding is enabled, allowing an unauthenticated network attacker to collide with queue-item primary keys, set far-future delivery timestamps, or preload retry counters. The broader CWE-502 object-injection primitive is not reachable solely by an unauthenticated HTTP caller because the vendor patch confirms HTTP input cannot name a class for unserialize; full deserialization exploitation requires an attacker who can already write to the owa_queue_item table or the queue log file, such as via SQL injection, stolen database credentials, or a restored/tampered table. No public exploit identified at time of analysis; vendor-released patch is version 1.8.2.
Cross-site scripting (XSS) vulnerability in the login page in Open Web Analytics (OWA) before 1.5.6 allows remote attackers to inject arbitrary web script or HTML via the owa_user_id parameter to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
SQL injection vulnerability in the password reset page in Open Web Analytics (OWA) before 1.5.5 allows remote attackers to execute arbitrary SQL commands via the owa_email_address parameter in a. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.