CVE-2017-1000501

CRITICAL9.8EPSS 6.5%

awstats - security update

Published: 1/3/2018Modified: 11/19/2025

Also known as:ALPINE-CVE-2017-1000501DEBIAN-CVE-2017-1000501

Description

Awstats version 7.6 and earlier is vulnerable to a path traversal flaw in the handling of the "config" and "migrate" parameters resulting in unauthenticated remote code execution.

Affected packages (4)

Alpine/awstatsfrom 0, < 7.6-r2
Debian/awstatsfrom 0, < 7.6+dfsg-2
Debian/awstatsfrom 0, < 7.0~dfsg-7+deb7u1
Debian/awstatsfrom 0, < 7.2+dfsg-1+deb8u1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (2)

ADVISORYhttps://security.alpinelinux.org/vuln/CVE-2017-1000501
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2017-1000501