Critical

Improper Privilege Management in Open Web Analytics

Disclosed: 19.03.2022
Updated: 11.10.2026 10:22

Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '<?php (instead of the intended "<?php sequence) aren't handled by the PHP interpreter.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
Composer package	open-web-analytics/open-web-analytics	< 1.7.4	1.7.4

References

CVSS score 9.8/10

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-269
Platform: Composer
Package: open-web-analytics/open-web-analytics
Disclosed: 19.03.2022
Updated: 11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-pr9q-v585-qv2w - CC BY 4.0

Vulnerability history: open-web-analytics/open-web-analytics

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries: 2
First → latest: 03.2022 09.2025
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

Critical 1
Medium 1

Disclosures per year

2022: 1
2023: 0
2024: 0
2025: 1
2026: 0

15.09.2025

Open Web Analytics Server is vulnerable to SQL Injection

Medium · 5.0 CVE-2025-59397 < 1.8.1 1.8.1
19.03.2022

Improper Privilege Management in Open Web Analytics this entry

Critical · 9.8 CVE-2022-24637 < 1.7.4 1.7.4

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application