4.3

CVE-2008-5080

awstats.pl in AWStats 6.8 and earlier does not properly remove quote characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the query_string parameter.  NOTE: this issue exists because of an incomplete fix for CVE-2008-3714.

Data is provided by the National Vulnerability Database (NVD)
Awstats ≫ Awstats Version <= 6.8
Awstats ≫ Awstats Version5.0
Awstats ≫ Awstats Version5.1
Awstats ≫ Awstats Version5.2
Awstats ≫ Awstats Version5.3
Awstats ≫ Awstats Version5.4
Awstats ≫ Awstats Version5.5
Awstats ≫ Awstats Version5.6
Awstats ≫ Awstats Version5.7
Awstats ≫ Awstats Version5.8
Awstats ≫ Awstats Version5.9
Awstats ≫ Awstats Version6.0
Awstats ≫ Awstats Version6.1
Awstats ≫ Awstats Version6.2
Awstats ≫ Awstats Version6.3
Awstats ≫ Awstats Version6.4
Awstats ≫ Awstats Version6.5
Awstats ≫ Awstats Version6.6
Awstats ≫ Awstats Version6.7
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.4% 0.596
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.