Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Webiste Security Vulnerability Reporting #6216

Closed
erniravtrivedi opened this issue Sep 15, 2014 · 1 comment
Closed

Webiste Security Vulnerability Reporting #6216

erniravtrivedi opened this issue Sep 15, 2014 · 1 comment
Labels
Bug For errors / faults / flaws / inconsistencies etc. worksforme The issue cannot be reproduced and things work as intended.

Comments

@erniravtrivedi
Copy link

Hi there,

I have found a Security Vulnerability on one of your website i.e. piwik.org

The vulnerability that I have found is Cross Frame Scripting followed by Clickjacking Attack.

The vulnerability exists as you have no protections against your website framing.

Thus, you haven't implemented X-Frame Options on Server Side for the prevention which you must implement now.

Severity : Medium

Impact : An attacker can control the actions of user(victim) and can perform some actions with the help of victim but without the knowledge of victim.

For more information, please visit https://www.owasp.org/index.php/Clickjacking and https://www.owasp.org/index.php/Cross_Frame_Scripting.

I am also attaching a snapshot of Iframed page. Please find the attachment for the same.

Do evaluate and inform accordingly.

Best Regards,

Nirav M. Trivedi
(Security Researcher)
@mattab
Copy link
Member

mattab commented Sep 17, 2014

Hi Nirav,

Thank you for your security report! we provide our security information at: http://piwik.org/security/

The preferred way for responsible disclosure is to send an email to security@piwik.org the shortlisted list of core developers who will handle the disclosure and fix ASAP.

Thank you in advance for your report to security@piwik.org and helping to make security better for the whole community!

@mattab mattab closed this as completed Sep 17, 2014
@mattab mattab added worksforme The issue cannot be reproduced and things work as intended. Bug For errors / faults / flaws / inconsistencies etc. labels Sep 17, 2014
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Bug For errors / faults / flaws / inconsistencies etc. worksforme The issue cannot be reproduced and things work as intended.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@mattab @erniravtrivedi