CVE-2006-3681

Multiple cross-site scripting (XSS) vulnerabilities in awstats.pl in AWStats 6.5 build 1.857 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) refererpagesfilter, (2) refererpagesfilterex, (3) urlfilterex, (4) urlfilter, (5) hostfilter, or (6) hostfilterex parameters, a different set of vectors than CVE-2006-1945.

CVSS v2.0 2.6 LOW

2.6^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:H/Au:N/C:N/I:P/A:N

Exploitability : 4.9 / Impact : 2.9

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://secunia.com/advisories/19725	Exploit Vendor Advisory
http://www.ubuntu.com/usn/usn-360-1
http://secunia.com/advisories/22306
http://pridels0.blogspot.com/2006/04/awstats-65x-multiple-vuln.html
http://www.vupen.com/english/advisories/2006/1421
https://exchange.xforce.ibmcloud.com/vulnerabilities/25879

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:awstats:awstats:*:*:*:*:*:*:*:*

Information

Published : 2006-07-21 07:03

Updated : 2017-07-19 18:32

NVD link : CVE-2006-3681

Mitre link : CVE-2006-3681

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

awstats

awstats

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://secunia.com/advisories/19725", "name": "19725", "tags": ["Exploit", "Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.ubuntu.com/usn/usn-360-1", "name": "USN-360-1", "tags": [], "refsource": "UBUNTU"}, {"url": "http://secunia.com/advisories/22306", "name": "22306", "tags": [], "refsource": "SECUNIA"}, {"url": "http://pridels0.blogspot.com/2006/04/awstats-65x-multiple-vuln.html", "name": "http://pridels0.blogspot.com/2006/04/awstats-65x-multiple-vuln.html", "tags": [], "refsource": "MISC"}, {"url": "http://www.vupen.com/english/advisories/2006/1421", "name": "ADV-2006-1421", "tags": [], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25879", "name": "awstats-multiple-xss(25879)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in awstats.pl in AWStats 6.5 build 1.857 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) refererpagesfilter, (2) refererpagesfilterex, (3) urlfilterex, (4) urlfilter, (5) hostfilter, or (6) hostfilterex parameters, a different set of vectors than CVE-2006-1945."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2006-3681", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 2.6, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "LOW", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2006-07-21T14:03Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:awstats:awstats:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "6.5_1.857"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-07-20T01:32Z"}