CVE-2022-24637 Improper Privilege Management in Open Web Analytics

What is CVE-2022-24637?

CVE-2022-24637 is a critical vulnerability in n/a, published on 18 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '<?php (instead of the intended "<?php sequence) aren't handled by the PHP interpreter.

Weakness: CWE-269

Which versions are affected by CVE-2022-24637?

2 open source packages ship an affected version, including open-web-analytics/open-web-analytics. It affects 1 product.

Products include Openwebanalytics Open Web Analytics.

How do I fix CVE-2022-24637?

Upgrade open-web-analytics/open-web-analytics to 1.7.4 or later.

Is CVE-2022-24637 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-24637 exists.

Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 7 proofs of concept on GitHub.

Other vulnerabilities in n/a

• CVE-2014-2294 Deserialization in n/a Critical 9.8
• CVE-2014-1457 Cross-site request forgery in n/a High 8.8
• CVE-2014-1206 SQL injection in n/a High 7.5
• CVE-2010-2677 Code injection in n/a Medium 5.1
• CVE-2010-2676 Path traversal in n/a Medium 5.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-pr9q-v585-qv2w.