Re: CVE request: Piwik before 1.7

[Henri Salo <henri () nerv fi>]

On Tue, May 08, 2012 at 10:44:46PM -0600, Kurt Seifried wrote:
> On 05/08/2012 03:03 AM, Hanno Böck wrote:
> > Hi,
> >
> > http://piwik.org/blog/2012/02/7775/
> >
> > Information is very rare: "We would like to thank the following
> > security researchers for their responsible disclosure of XSS &
> > click-jacking issues: Piotr Duszynski, Sergey Markov, Mauro
> > Gentile."
> >
> > I'd suggest assigning 3 CVEs with subjects like
> >
> > "Unknown XSS or clickjacking issue identified by Piotr Duszynski" 
> > "Unknown XSS or clickjacking issue identified by Sergey Markov" 
> > "Unknown XSS or clickjacking issue identified by Mauro Gentile"
>
>
> We would like to thank the following security researchers for their
> responsible disclosure of XSS & click-jacking issues: Piotr Duszynski,
> Sergey Markov, Mauro Gentile.
> Thank you for disclosing security issues to the Piwik team, ensuring a
> healthy and safe experience for the whole community!
>
> I can't find anything else. Can you send the code commits that address
> this?
>
>
> - -- 
> Kurt Seifried Red Hat Security Response Team (SRT)

I requested more details from security@ and got following reply from Matthieu Aubry:

"""
Hi Henri,

I agree it sounds like a good idea to describe exactly what went
wrong, in a spirit of openness and learning from mistakes.

however,  Piwik data is very sensitive. Many Piwik users don't upgrade
and use  older vulnerable version, sometimes data leaking are
possible. If we give the details, first of all it takes time and
energy which is already 100% booked, and secondly it would help black
hat write bots to scrape and do bad.

This is not a good investment of our time sorry...
but I appreciate your work :)
Matt
"""

I do not think this is good way to improve security. In my opinion these issues still need CVE-identifiers, but details 
will limit to "unknown XSS" etc. Does these get three or one CVE-identifier?

- Henri Salo