CVE-2020-29600
07.12.2020, 20:15
In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501.
| Vendor | Product | Version |
|---|---|---|
| awstats | awstats | 𝑥 ≤ 7.7 |
| debian | debian_linux | 9.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
References