Published: 03/01/2018 Updated: 27/07/2020

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Awstats version 7.6 and previous versions is vulnerable to a path traversal flaw in the handling of the "config" and "migrate" parameters resulting in unauthenticated remote code execution.

Vulnerable Product	Search on Vulmon	Subscribe to Product
awstats awstats
debian debian linux 7.0
debian debian linux 8.0
debian debian linux 9.0

AWStats could be made to run programs if it received specially crafted network traffic ...

The cPanel Security Team discovered that awstats, a log file analyzer, was vulnerable to path traversal attacks A remote unauthenticated attacker could leverage that to perform arbitrary code execution For the oldstable distribution (jessie), this problem has been fixed in version 72+dfsg-1+deb8u1 For the stable distribution (stretch), this pro ...

Debian Bug report logs - #891469 awstats: Path traversal in config parameter if site config is missing (CVE-2020-29600) Package: awstats; Maintainer for awstats is Debian QA Group <packages@qadebianorg>; Source for awstats is src:awstats (PTS, buildd, popcon) Reported by: Tomaž Šolc <tomazsolc@tablixorg> Date: ...

Debian Bug report logs - #977190 awstats: CVE-2020-35176 Package: src:awstats; Maintainer for src:awstats is Debian QA Group <packages@qadebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 12 Dec 2020 09:21:01 UTC Severity: important Tags: security, upstream Found in version awstats/78-1 ...

Debian Bug report logs - #885835 awstats: CVE-2017-1000501: path traversals in config and migrate parameter Package: src:awstats; Maintainer for src:awstats is Debian QA Group <packages@qadebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 30 Dec 2017 10:09:02 UTC Severity: grave Tags: patc ...

CWE-22 https://github.com/eldy/awstats/commit/cf219843a74c951bf5986f3a7fffa3dcf99c3899 https://github.com/eldy/awstats/commit/06c0ab29c1e5059d9e0279c6b64d573d619e1651 http://www.awstats.org/https://www.debian.org/security/2018/dsa-4092 https://lists.debian.org/debian-lts-announce/2018/01/msg00012.html https://security.gentoo.org/glsa/202007-37 https://usn.ubuntu.com/3518-1/https://nvd.nist.gov

CVE-2017-1000501

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect