Summary
It was discovered that AWStats did not properly sanitize the content of
whois responses in the hostinfo plugin. An attacker could possibly use
this issue to conduct cross-site scripting (XSS) attacks.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | awstats | 7.6+dfsg-2ubuntu0.18.04.2 |
| Ubuntu · 20.04 LTS 20.04:LTS | awstats | 7.6+dfsg-2ubuntu0.20.04.2 |
| Ubuntu · 22.04 LTS 22.04:LTS | awstats | 7.8-2ubuntu0.22.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | awstats | 7.4+dfsg-1ubuntu0.4+esm2 |
Vulnerabilities 1
-
Medium 6.1
AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper ch…
References
-
report
https://ubuntu.com/security/CVE-2022-46391