Description
awstats.pl in AWStats 6.8 and earlier does not properly remove quote characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the query_string parameter. NOTE: this issue exists because of an incomplete fix for CVE-2008-3714.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | awstats | 6.7.dfsg-5.1 | — |
| Debian 13 | awstats | 6.7.dfsg-5.1 | — |
| Debian 12 | awstats | 6.7.dfsg-5.1 | — |
| Debian 4.0 | awstats | 6.5+dfsg-1+etch1 | DSA-1679-1 |
Advisories 1
- DSA-1679-1 awstats - cross-site scripting Debian Security (DSA / DLA) · Mar 9, 2026
References
- 33002 third-party-advisory
- awstats-querystring-xss(47116) vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=474396
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=495432#21
- USN-686-1 vendor-advisory