Description
Piwik before 1.1 does not prevent the rendering of the login form inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
References
- 45787 vdb-entry
- http://dev.piwik.org/trac/ticket/1679
- http://piwik.org/blog/2011/01/piwik-1-1-2/
- piwik-loginform-clickjacking(64640) vdb-entry
- 70383 vdb-entry