Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain…
Priority CRITICAL 87CWE-269Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-269.
Summary
Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '<?php (instead of the intended "<?php sequence) aren't handled by the PHP interpreter.
Why it matters now
EPSS 0.99055 99th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed open-web-analytics/open-web-analytics (Packagist): 1.7.4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | open-web-analytics/open-web-analytics (Packagist) | before 1.7.4 | 1.7.4 | Patch available | GHSA-pr9q-v585-qv2w |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- open-web-analytics/open-web-analytics (Packagist) Vendor— Affected before 1.7.4 Fixed in 1.7.4 Patch available GHSA-pr9q-v585-qv2w
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openwebanalytics:open_web_analytics:*:*:*:*:*:*:*:* | before 1.7.4 | Vulnerable | Open Web Analytics |
- cpe:2.3:a:openwebanalytics:open_web_analytics:*:*:*:*:*:*:*:* Versions before 1.7.4 Vulnerable ·Open Web Analytics
Remediation
- Fix · GHSA-pr9q-v585-qv2w open-web-analytics/open-web-analytics (Packagist) Fixed in 1.7.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-24637
- 2026-10-03 Alias added: GHSA-pr9q-v585-qv2w
References
Exploit 2
Advisory 2
More Open Web Analytics vulnerabilities
- TI-2014-01820 Open Web Analytics (OWA) before 1.5.7 allows remote attackers to conduct PHP object… CVSS 3.0CRITICAL 9.8
- TI-2014-01122 Open Web Analytics (OWA) before 1.5.6 improperly generates random nonce values, which… CVSS 3.0HIGH 8.8
- TI-2014-00920 SQL injection vulnerability in the password reset page in Open Web Analytics (OWA) before… CVSS 2.0HIGH 7.5
- TI-2010-02567 PHP remote file inclusion vulnerability in mw_plugin.php in Open Web Analytics (OWA)… CVSS 2.0MEDIUM 5.1
- TI-2010-02566 Multiple directory traversal vulnerabilities in index.php in Open Web Analytics (OWA)… CVSS 2.0MEDIUM 5.0
- TI-2014-01121 Cross-site scripting (XSS) vulnerability in the login page in Open Web Analytics (OWA)… CVSS 2.0MEDIUM 4.3
Sources
- CVE-2022-24637 · CVE Program
- CVE-2022-24637 · NVD
- FIRST EPSS
- GHSA-pr9q-v585-qv2w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences