CVE-2014-2294 Open Web Analytics (OWA) before 1.5.7 allows remote attackers to conduct PHP object injection attacks via a crafted serialized object in the owa_event parameter to queue.php.
CriticalCVSS 9.8
EPSS 2.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Open Web Analytics (OWA) before 1.5.7 allows remote attackers to conduct PHP object injection attacks via a crafted serialized object in the owa_event parameter to queue.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openwebanalytics open web analytics | < 1.5.7 | 1.5.7 |
References
- karmainsecurity.com third-party-advisory
- www.openwebanalytics.com patch release-notes vendor-advisory
- secuniaresearch.flexerasoftware.com permissions-required
- secuniaresearch.flexerasoftware.com third-party-advisory
- 66076 third-party-advisory vdb-entry