CVE-2006-2237

Sažetak

The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter.

Reference

http://awstats.sourceforge.net/awstats_security_news.php
http://secunia.com/advisories/19969
http://secunia.com/advisories/20170
http://secunia.com/advisories/20186
http://secunia.com/advisories/20496
http://secunia.com/advisories/20710
http://security.gentoo.org/glsa/glsa-200606-06.xml
http://www.debian.org/security/2006/dsa-1058
http://www.novell.com/linux/security/advisories/2006_33_awstats.html
http://www.osreviews.net/reviews/comm/awstats
http://www.osvdb.org/25284
http://www.securityfocus.com/bid/17844
http://www.vupen.com/english/advisories/2006/1678
http://www.vuxml.org/freebsd/2df297a2-dc74-11da-a22b-000c6ec775d9.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/26287
https://usn.ubuntu.com/285-1/

CVSS

Base:	5.1
Impact:	6.4
Exploitability:	4.9

Pristup

Vektor	Složenost	Autentikacija
NETWORK	HIGH	NONE

Impact

Povjerljivost	Cjelovitost	Dostupnost
PARTIAL	PARTIAL	PARTIAL

CVSS vektor

AV:N/AC:H/Au:N/C:P/I:P/A:P

Zadnje važnije ažuriranje

03-10-2018 - 21:40

Objavljeno

08-05-2006 - 23:02