awstats.pl in AWStats 6.8 and earlier does not properly remove quote characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the query_string parameter. NOTE: this issue exists because of an incomplete fix for CVE-2008-3714.

Use Debian's patch for CVE-2008-3714 (rh#474396)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Morgan Todd discovered that AWStats did not correctly strip quotes from certain parameters, allowing for an XSS attack when running as a CGI. If a user was tricked by a remote attacker into following a specially crafted URL, the user's authentication information could be exposed for the domain where AWStats was hosted.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Secunia reports :

Morgan Todd has discovered a vulnerability in AWStats, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed in the URL to awstats.pl is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Successful exploitation requires that the application is running as a CGI script.

ID	Name	Product	Family	Severity
36742	Fedora 10 : awstats-6.8-3.fc10 (2008-10950)	Nessus	Fedora Local Security Checks	medium
36652	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : awstats vulnerability (USN-686-1)	Nessus	Ubuntu Local Security Checks	medium
35290	FreeBSD : awstats -- multiple XSS vulnerabilities (27d78386-d35f-11dd-b800-001b77d09812)	Nessus	FreeBSD Local Security Checks	medium
35065	Fedora 9 : awstats-6.8-3.fc9 (2008-10962)	Nessus	Fedora Local Security Checks	medium
35063	Fedora 8 : awstats-6.8-3.fc8 (2008-10938)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2008-5080

medium

Tenable Plugins

medium

medium

medium

medium

medium