CVE-2020-35176

In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname (omitting the initial /etc), even though it was intended to only read a…

published December 11, 2020

CVSS
—
EPSS
2%
Percentile
82.2
In the wild
Unconfirmed
What it is

In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname (omitting the initial /etc), even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501 and CVE-2020-29600.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02175 · 82.2th percentile
Published
2020-12-11T23:16Z
EPSS history
Timeline
  • 11 DEC 23:16Z
    In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname (omitting the initial /etc), even though it was intended to only read a…
    cvelistv5