RCE in Awstats

CVE-2010-4367

awstats.cgi in AWStats before 7.0 accepts a configdir parameter in the URL, which allows remote attackers to execute arbitrary commands via a crafted configuration file located on a (1) WebDAV server or (2) NFS server.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.277 (97.9th percentile) — read the EPSS interpretation.

Affected products

Awstats — versions 3.0, 6.3, 2.2.4
N/a — versions n/a

Weakness classification (CWE)

CWE-94 — Code Injection

References

cve@mitre.org (vendor-advisory, x_refsource_MANDRIVA)
cve@mitre.org (Exploit, x_refsource_MISC)
cve@mitre.org (x_refsource_CONFIRM)