CVE-2006-3681

Multiple cross-site scripting (XSS) vulnerabilities in awstats.pl in AWStats 6.5 build 1.857 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) refererpagesfilter, (2) refererpagesfilterex, (3) urlfilterex, (4) urlfilter, (5) hostfilter, or (6) hostfilterex parameters, a different set of vectors than CVE-2006-1945.

CVSS v2.0 2.6 LOW

2.6^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:H/Au:N/C:N/I:P/A:N

Exploitability : 4.9 / Impact : 2.9

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://pridels0.blogspot.com/2006/04/awstats-65x-multiple-vuln.html
http://secunia.com/advisories/19725	Exploit Vendor Advisory
http://secunia.com/advisories/22306
http://www.ubuntu.com/usn/usn-360-1
http://www.vupen.com/english/advisories/2006/1421
https://exchange.xforce.ibmcloud.com/vulnerabilities/25879

Configurations

Configuration 1 (hide)

cpe:2.3:a:awstats:awstats:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2006-07-21 14:03

Updated : 2017-07-20 01:32

NVD link : CVE-2006-3681

Mitre link : CVE-2006-3681

CVE.ORG link : CVE-2006-3681

JSON object : View

Products Affected

awstats

awstats

CWE

NVD-CWE-Other

{"id": "CVE-2006-3681", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.6, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2006-07-21T14:03:00.000", "references": [{"url": "http://pridels0.blogspot.com/2006/04/awstats-65x-multiple-vuln.html", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/19725", "tags": ["Exploit", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/22306", "source": "cve@mitre.org"}, {"url": "http://www.ubuntu.com/usn/usn-360-1", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2006/1421", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25879", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in awstats.pl in AWStats 6.5 build 1.857 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) refererpagesfilter, (2) refererpagesfilterex, (3) urlfilterex, (4) urlfilter, (5) hostfilter, or (6) hostfilterex parameters, a different set of vectors than CVE-2006-1945."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en awstats.pl de AWStats 6.5 build 1.857 y anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s de los par\u00e1metros (1) refererpagesfilter, (2) refererpagesfilterex, (3) urlfilterex, (4) urlfilter, (5) hostfilter, o (6) hostfilterex, un juego de vectores distinto de CVE-2006-1945."}], "lastModified": "2017-07-20T01:32:29.337", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:awstats:awstats:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EAE4E972-EFD0-4226-8917-8C71CCC551AF", "versionEndIncluding": "6.5_1.857"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}