CVE-2019-12215

MEDIUM

Matomo 3.9.1 - Full Path Disclosure via Error Message in Safe Mode Template

Title source: llm

Description

A full path disclosure vulnerability was discovered in Matomo v3.9.1 where a user can trigger a particular error to discover the full path of Matomo on the disk, because lastError.file is used in plugins/CorePluginsAdmin/templates/safemode.twig. NOTE: the vendor disputes the significance of this issue, stating "avoid reporting path disclosures, as we don't consider them as security vulnerabilities.

References (1)

Core 1

Core References

Exploit, Third Party Advisory x_refsource_misc

https://github.com/matomo-org/matomo/issues/14464

Scores

CVSS v3 4.3

EPSS 0.0123

EPSS Percentile 65.0%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Details

CWE

CWE-209

Status published

Products (1)

matomo/matomo 3.9.1

Published May 20, 2019

Tracked Since Feb 18, 2026