CVE-2006-2644 — Awstats vulnerability

5 documents5 sources

Severity

4.0MEDIUMNVD

EPSS

1.0%

top 22.53%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Awstats Debian Awstats

Timeline

PublishedMay 30

Latest updateMay 1

Description

AWStats 6.5, and possibly other versions, allows remote authenticated users to execute arbitrary code by using the configdir parameter to awstats.pl to upload a configuration file whose name contains shell metacharacters, then access that file using the LogFile directive.

CVSS vector

AV:N/AC:L/C:N/I:P/A:NExploitability: 8.0 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/awstats< awstats 6.5-2 (bookworm)

▶Debianawstats/awstats< 6.5-2+3

▶NVDawstats/awstats6.4_1, 6.5, 6.5_1+2

Patches

Patch: secunia.com ↗Patch: www.debian.org ↗Patch: www.osreviews.net ↗

🔴Vulnerability Details

GHSA

GHSA-cpq2-7cfm-gfc2: AWStats 6↗2022-05-01

▶

OSV

CVE-2006-2644: AWStats 6↗2006-05-30

▶

📋Vendor Advisories

Ubuntu

awstats vulnerability↗2006-06-08

▶

Debian

CVE-2006-2644: awstats - AWStats 6.5, and possibly other versions, allows remote authenticated users to e...↗2006

▶