RCE in Awstats
CVE-2010-4368
awstats.cgi in AWStats before 7.0 on Windows accepts a configdir parameter in the URL, which allows remote attackers to execute arbitrary commands via a crafted configuration file located at a UNC share pathname.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.025 (83.2th percentile) — read the EPSS interpretation.
Affected products
- Awstats — versions 3.0, 6.3, 2.2.4
- Microsoft Windows
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (US Government Resource, x_refsource_CERT-VN, third-party-advisory)
- cve@mitre.org (x_refsource_MISC)
- cve@mitre.org (Exploit, x_refsource_MISC)