Awstats version 7.6 and earlier is vulnerable to a path traversal flaw in the handling of the "config" and "migrate" parameters resulting in unauthenticated remote code execution.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade awstats | Jan 15, 2018 | Jan 3, 2018 |
| Debian | — | Upgrade awstats | Jan 20, 2018 | Jan 3, 2018 |
| Freebsd | — | Upgrade awstats | Jan 9, 2018 | Jan 8, 2018 |
| Gentoo Linux | — | Upgrade www-misc/awstats. | Jul 28, 2020 | Jan 3, 2018 |
| Ubuntu | — | Upgrade awstats (Ubuntu Pro)Upgrade awstats | Jan 9, 2018 | Jan 3, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub