CVE-2006-2237

None

CVSS

—

EPSS

58.4%

Published

May 8, 2006

CISA due date

—

The record

The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter.

Affected packages

Ecosystem	Package	Fixed
Debian:10	awstats	6.5-2
Debian:11	awstats	6.5-2
Debian:12	awstats	6.5-2
Debian:13	awstats	6.5-2
Debian:3.0	awstats	<not-affected>
Debian:3.1	awstats	6.4-1sarge2

Related vulnerabilities

CVE-2010-4367 awstats.cgi in AWStats before 7.0 accepts a configdir parameter in the URL, which allows… Also affects awstats
CVE-2005-0116 AWStats 6.1, and other versions before 6.3, allows remote attackers to execute arbitrary… Also affects awstats