{"id":"GHSA-2qr8-h6pq-m27v","aliases":["CVE-2011-4941"],"title":"Piwik (now Matomo) Vulnerable to Arbitrary Code Execution","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"Unspecified vulnerability in Piwik 1.2 through 1.4 allows remote attackers with the view permission to execute arbitrary code via unknown attack vectors.","severity":"medium","score":6.3,"published":"2022-05-13T01:30:29.000Z","modified":"2025-04-12T00:27:23.007Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"piwik/piwik","sources":[{"name":"OSV · GHSA-2qr8-h6pq-m27v","url":"https://osv.dev/vulnerability/GHSA-2qr8-h6pq-m27v"}],"ranges":[{"events":[{"introduced":"1.2"},{"fixed":"1.5"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["1.5"]},{"ecosystem":"Packagist","name":"matomo/matomo","sources":[{"name":"OSV · GHSA-2qr8-h6pq-m27v","url":"https://osv.dev/vulnerability/GHSA-2qr8-h6pq-m27v"}],"ranges":[{"events":[{"introduced":"1.2"},{"fixed":"1.5"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["1.5"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2011-4941","https://github.com/matomo-org/matomo","https://web.archive.org/web/20110626223028/http://piwik.org/blog/2011/06/piwik-1-5-security-advisory","http://www.openwall.com/lists/oss-security/2012/03/18/1","http://www.openwall.com/lists/oss-security/2012/03/19/8"],"sources":[{"name":"OSV","id":"GHSA-2qr8-h6pq-m27v","modified":"2025-04-12T00:27:23.007073Z","url":"https://osv.dev/vulnerability/GHSA-2qr8-h6pq-m27v"}],"assessments":[{"source":"OSV","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","score":6.3}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T23:25:34.350Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}