Summary
Sean Boran discovered that AWStats incorrectly filtered certain parameters.
A remote attacker could possibly use this issue to execute arbitrary code.
(CVE-2020-29600)
It was discovered that AWStats incorrectly filtered certain parameters. A
remote attacker could possibly use this issue to access sensitive
information. (CVE-2020-35176)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | awstats | 7.6+dfsg-2ubuntu0.18.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | awstats | 7.6+dfsg-2ubuntu0.20.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | awstats | 7.4+dfsg-1ubuntu0.4+esm1 |
Vulnerabilities 3
-
Unscored —
Awstats version 7.6 and earlier is vulnerable to a path traversal flaw in the handling of the "config" and "migrate" pa…
-
Unscored —
In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only re…
-
Unscored —
In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname (omitting the initial /etc), eve…