The path disclosure weakness described in CVE-2011-3791 does not affect Piwik 1.1.

Beginning with Piwik 0.6.3 (released June 2010), the installer creates Apache .htaccess and IIS web.config files to
prevent direct access to .php files. Users upgrading from an earlier beta version of Piwik, or using a different web server, should consult their web server’s configuration guide.

Please note “path disclosure vulnerabilities” do not qualify for Piwik’s Security Bug Bounty Program.

Reference: CVE-2011-3791

Anthon Pang

- active contributor for years, Anthon has designed some some major features in Piwik such as the first version of the Javascript tracker. He still regularly advises the team.

Any questions?

Many answers and more information about Piwik You can find here:

We are social

Follow us: