CVE-2025-4415 - Vulnerability Details - OpenCVE

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Piwik PRO allows Cross-Site Scripting (XSS).This issue affects Piwik PRO: from 0.0.0 before 1.3.2.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Matomo	Piwik Pro

Configuration 1 [-]

cpe:2.3:a:matomo:piwik_pro:*:*:*:*:*:drupal:*:*

No data.

References

Link	Providers
https://www.drupal.org/sa-contrib-2025-058

History

Wed, 25 Jun 2025 16:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Matomo Matomo piwik Pro
CPEs		cpe:2.3:a:matomo:piwik_pro::::::drupal::*
Vendors & Products		Matomo Matomo piwik Pro

Wed, 21 May 2025 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 4.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 21 May 2025 16:30:00 +0000

Type	Values Removed	Values Added
Description		Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Piwik PRO allows Cross-Site Scripting (XSS).This issue affects Piwik PRO: from 0.0.0 before 1.3.2.
Title		Piwik PRO - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-058
Weaknesses		CWE-79
References		https://www.drupal.org/sa-contrib-2025-058

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2025-05-21T16:21:29.463Z

Updated: 2025-05-21T16:43:21.185Z

Reserved: 2025-05-07T16:02:53.100Z

Link: CVE-2025-4415

Vulnrichment

Updated: 2025-05-21T16:43:02.758Z

NVD

Status : Analyzed

Published: 2025-05-21T17:15:58.970

Modified: 2025-06-25T15:23:59.237

Link: CVE-2025-4415

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-4415", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2025-05-07T16:02:53.100Z", "datePublished": "2025-05-21T16:21:29.463Z", "dateUpdated": "2025-05-21T16:43:21.185Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.drupal.org/project/piwik_pro", "defaultStatus": "unaffected", "product": "Piwik PRO", "repo": "https://git.drupalcode.org/project/piwik_pro", "vendor": "Drupal", "versions": [{"lessThan": "1.3.2", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Pierre Rudloff (prudloff)"}, {"lang": "en", "type": "remediation developer", "value": "Hartsak (hartsak)"}, {"lang": "en", "type": "remediation developer", "value": "Josha Hubbers (joshahubbers)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}, {"lang": "en", "type": "coordinator", "value": "Pierre Rudloff (prudloff)"}], "datePublic": "2025-05-14T18:04:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Piwik PRO allows Cross-Site Scripting (XSS).<p>This issue affects Piwik PRO: from 0.0.0 before 1.3.2.</p>"}], "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Piwik PRO allows Cross-Site Scripting (XSS).This issue affects Piwik PRO: from 0.0.0 before 1.3.2."}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-05-21T16:21:29.463Z"}, "references": [{"url": "https://www.drupal.org/sa-contrib-2025-058"}], "source": {"discovery": "UNKNOWN"}, "title": "Piwik PRO - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-058", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-05-21T16:42:32.661139Z", "id": "CVE-2025-4415", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-21T16:43:21.185Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-4415", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-21T16:42:32.661139Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-21T16:43:02.758Z"}}], "cna": {"title": "Piwik PRO - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-058", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Pierre Rudloff (prudloff)"}, {"lang": "en", "type": "remediation developer", "value": "Hartsak (hartsak)"}, {"lang": "en", "type": "remediation developer", "value": "Josha Hubbers (joshahubbers)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}, {"lang": "en", "type": "coordinator", "value": "Pierre Rudloff (prudloff)"}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/piwik_pro", "vendor": "Drupal", "product": "Piwik PRO", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "1.3.2", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/piwik_pro", "defaultStatus": "unaffected"}], "datePublic": "2025-05-14T18:04:00.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2025-058"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Piwik PRO allows Cross-Site Scripting (XSS).This issue affects Piwik PRO: from 0.0.0 before 1.3.2.", "supportingMedia": [{"type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Piwik PRO allows Cross-Site Scripting (XSS).<p>This issue affects Piwik PRO: from 0.0.0 before 1.3.2.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-05-21T16:21:29.463Z"}}}, "cveMetadata": {"cveId": "CVE-2025-4415", "state": "PUBLISHED", "dateUpdated": "2025-05-21T16:43:21.185Z", "dateReserved": "2025-05-07T16:02:53.100Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2025-05-21T16:21:29.463Z", "assignerShortName": "drupal"}, "dataVersion": "5.1"}