Fluid Attacks Database

Description

Cross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.8 allows remote attackers to inject arbitrary web script or HTML via the query_string, a different vulnerability than CVE-2006-3681 and CVE-2006-1945.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 11	awstats	>=0 <6.7.dfsg-5.1	6.7.dfsg-5.1
debian 13	awstats	>=0 <6.7.dfsg-5.1	6.7.dfsg-5.1
debian 12	awstats	>=0 <6.7.dfsg-5.1	6.7.dfsg-5.1
debian 14	awstats	>=0 <6.7.dfsg-5.1	6.7.dfsg-5.1

Aliases

1. CVE-2008-37142. NVD-2008-37143. OSV-DEBIAN-2008-37144. OSV-2008-37145. SECURITY-TRACKER-CVE-2008-3714

References

1. https://www.exploit-db.com/exploits/32258

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.