Cross site scripting

2008-12-0318:30:00

PRIOn knowledge base

www.prio-n.com

1123

5.7 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.003 Low

EPSS

Percentile

71.2%

JSON

awstats.pl in AWStats 6.8 and earlier does not properly remove quote characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the query_string parameter. NOTE: this issue exists because of an incomplete fix for CVE-2008-3714.

CPENameOperatorVersion
awstatseq5.7
awstatseq6.3
awstatseq6.5
awstatseq5.9
awstatseq6.1
awstatseq6.2
awstatseq5.0
awstatseq5.2
awstatseq5.6
awstatseq5.1