Published: 04/12/2022 Updated: 07/11/2023

CVSS v3 Base Score: 6.1 | Impact Score: 2.7 | Exploitability Score: 2.8

VMScore: 0

AWStats 7.x up to and including 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper checks.

Vulnerable Product	Search on Vulmon	Subscribe to Product
awstats awstats
debian debian linux 10.0
fedoraproject fedora 36
fedoraproject fedora 37

Debian Bug report logs - #1025410 awstats: CVE-2022-46391: XSS due to printing response from Net::XWhois without proper checks Package: src:awstats; Maintainer for src:awstats is Debian QA Group <packages@qadebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sun, 4 Dec 2022 09:33:02 UTC Severit ...

CWE-79 https://github.com/eldy/AWStats/pull/226 https://lists.debian.org/debian-lts-announce/2022/12/msg00010.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GRFYH4DE3COMI3LJCOQQXA4FWOABU6Z2/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MYUZIFVB4N3NK4WGNHRNXZKJITCJBJX4/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1025410 https://nvd.nist.gov

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2022-46391

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect