Servers and applications
CVE-2011-0400 Cookie.php in Piwik before 1.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
Severity Medium 5.0
Published 10 Jan 2011
Last changed 16 Jun 2026
Added to UpHeron 21 Oct 2026 Exploit chance 1.3% in the next 30 daysHigher than 69% of CVEs. EPSS by FIRST , 12 Nov 2026
Attack Over the network · No login needed
Attacker can Read some data
CVSS vector AV:N/AC:L/Au:N/C:P/I:N/A:N
Sources NVD Affected software Software Affected versions MatomoServers and applications · cpe:a:matomo:matomo Version 0.9.9 Version 0.9 Version 0.8 Version 0.7 All 67 release lines Every version up to 1.0 Version 0.1 Version 0.1.1 Version 0.1.2 Version 0.1.3 Version 0.1.4 Version 0.1.5 Version 0.1.6 Version 0.1.7 Version 0.1.8 Version 0.1.9 Version 0.1.10 Version 0.2.1 Version 0.2.2 Version 0.2.3 Version 0.2.4 Version 0.2.5 Version 0.2.6 Version 0.2.7 Version 0.2.8 Version 0.2.9 Version 0.2.10 Version 0.2.11 Version 0.2.12 Version 0.2.13 Version 0.2.14 Version 0.2.16 Version 0.2.17 Version 0.2.18 Version 0.2.19 Version 0.2.20 Version 0.2.22 Version 0.2.23 Version 0.2.24 Version 0.2.25 Version 0.2.26 Version 0.2.27 Version 0.2.28 Version 0.2.29 Version 0.2.30 Version 0.2.31 Version 0.2.32 Version 0.2.33 Version 0.2.34 Version 0.4-rc1 Version 0.4-rc2 Version 0.4-rc3 Version 0.4.1-rc1 Version 0.4.4 Version 0.4.5 Version 0.5 Version 0.5.1 Version 0.5.2 Version 0.5.3 Version 0.5.4 Version 0.5.5 Version 0.6 Version 0.6.1 Version 0.6.2 Version 0.6.3-rc1 Version 0.6.3-rc2 Version 0.6.3 Version 0.6.4 Version 0.7 Version 0.8 Version 0.9 Version 0.9.9
References NVD https://nvd.nist.gov/vuln/detail/CVE-2011-0400 CVE.org https://www.cve.org/CVERecord?id=CVE-2011-0400