CVE-2017-20175 json
DaSchTour matomo-mediawiki-extension Username Piwik.hooks.php cross site scripting
published 2023-02-05 3 y ago modified 2026-06-17 4 mo ago also GHSA-hc67-v29c-7g78 , EUVD-2023-0718
- cvss
- 2.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 49%
- public exploits
- 0
- none known
Summary
A vulnerability classified as problematic has been found in DaSchTour matomo-mediawiki-extension up to 2.4.2 on MediaWiki. This affects an unknown part of the file Piwik.hooks.php of the component Username Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 2.4.3 is able to address this issue. The patch is named 681324e4f518a8af4bd1f93867074c728eb9923d. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220203.
Patch / fix
- packagist mediawiki/matomo 2.4.3
- mediawiki matomo 2.4.3
Exploit prediction
0.61% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- github.com https://github.com/DaSchTour/matomo-mediawiki-extension/pull/17 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 2.6 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N |
| CNA | 3.0 | 2.6 | CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N |
| CNA | 2.0 | 2.1 | AV:N/AC:H/Au:S/C:N/I:P/A:N |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | mediawiki/matomo | <2.4.3 |
2.4.3 |
Affected products
- DaSchTour matomo-mediawiki-extension
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/DaSchTour/matomo-mediawiki-extension/pull/17
exploit, issue-tracking, web, patch
-
github.com
/DaSchTour/matomo-mediawiki-extension/commit/681324e4f518a8af4bd1f93867074c728eb9923d
patch, web
-
github.com
/DaSchTour/matomo-mediawiki-extension/releases/tag/v2.4.3
patch, web, release-notes
-
vuldb.com
/?id.220203
vdb-entry, technical-description, web, third-party-advisory
-
vuldb.com
/?ctiid.220203
signature, permissions-required, web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2017-20175
advisory
-
github.com
/DaSchTour/matomo-mediawiki-extension
package
Sources
- CVE List CVE-2017-20175
- GitHub Advisory GHSA-hc67-v29c-7g78
- NVD CVE-2017-20175
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.