The official piwik Docker images before fpm-alpine (Alpine specific) contain a blank password for a root user. Systems using the Piwik Docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Piwik_fpm-alpine_docker_image | Matomo | 3 (including) | 3 (including) |
| Piwik_fpm-alpine_docker_image | Matomo | 3.5 (including) | 3.5 (including) |
| Piwik_fpm-alpine_docker_image | Matomo | 3.5.1 (including) | 3.5.1 (including) |
| Piwik_fpm-alpine_docker_image | Matomo | 3.6 (including) | 3.6 (including) |
| Piwik_fpm-alpine_docker_image | Matomo | 3.6.0 (including) | 3.6.0 (including) |