DRUPAL-CONTRIB-2023-033 This module enables you to add the Matomo web statistics tracking system to your website.
A privileged user can inject malicious JavaScript into the Matomo module settings, leading to code execution on the website.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is DRUPAL-CONTRIB-2023-033?
DRUPAL-CONTRIB-2023-033 is a code injection vulnerability in drupal/matomo, published on 2 Aug 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
This module enables you to add the Matomo web statistics tracking system to your website.
The module does not check the Matomo JS code loaded on the website. So a user could configure the module to load JS from a malicious website.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer matomo" or "administer matomo tag manager" (D8+ only) to access the settings forms where this can be configured.
Which versions are affected by DRUPAL-CONTRIB-2023-033?
Linux distribution packages (1)
drupal/matomo Packagist:https://packages.drupal.org/8 | All versions | 1.22.0 |
How do I fix DRUPAL-CONTRIB-2023-033?
Apply the vendor's patch.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is DRUPAL-CONTRIB-2023-033 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2023-033 in the wild and no public exploit code.