CVE-2017-1000501 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 90%

Affected Products (NVD)

Vendor	Product	Version
awstats	awstats	𝑥 ≤ 7.6.0
debian	debian_linux	7.0
debian	debian_linux	8.0
debian	debian_linux	9.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

awstats

bookworm	7.8-3+deb12u1 fixed
bullseye	7.8-2+deb11u1 fixed
sid	7.9-1 fixed
trixie	7.9-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

awstats

artful	Fixed 7.6+dfsg-1ubuntu0.17.10.1 released
trusty	Fixed 7.2+dfsg-1ubuntu0.1 released
xenial	Fixed 7.4+dfsg-1ubuntu0.2 released
zesty	Fixed 7.6+dfsg-1ubuntu0.17.04.1 released

Common Weakness Enumeration

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References

http://www.awstats.org/

https://github.com/eldy/awstats/commit/06c0ab29c1e5059d9e0279c6b64d573d619e1651

https://github.com/eldy/awstats/commit/cf219843a74c951bf5986f3a7fffa3dcf99c3899

https://lists.debian.org/debian-lts-announce/2018/01/msg00012.html

https://security.gentoo.org/glsa/202007-37

https://www.debian.org/security/2018/dsa-4092

http://www.awstats.org/

https://github.com/eldy/awstats/commit/06c0ab29c1e5059d9e0279c6b64d573d619e1651

https://github.com/eldy/awstats/commit/cf219843a74c951bf5986f3a7fffa3dcf99c3899

https://lists.debian.org/debian-lts-announce/2018/01/msg00012.html

https://security.gentoo.org/glsa/202007-37

https://www.debian.org/security/2018/dsa-4092