Fluid Attacks Database

Description

awstats.pl in AWStats 6.8 and earlier does not properly remove quote characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the query_string parameter. NOTE: this issue exists because of an incomplete fix for CVE-2008-3714.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 13	awstats	>=0 <6.7.dfsg-5.1	6.7.dfsg-5.1
debian 11	awstats	>=0 <6.7.dfsg-5.1	6.7.dfsg-5.1
debian 12	awstats	>=0 <6.7.dfsg-5.1	6.7.dfsg-5.1
debian 14	awstats	>=0 <6.7.dfsg-5.1	6.7.dfsg-5.1

Aliases

1. CVE-2008-50802. NVD-2008-50803. OSV-DEBIAN-2008-50804. OSV-2008-50805. SECURITY-TRACKER-CVE-2008-5080

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.