CVEvulnerability

CVE-2008-5080

4.3 MEDIUM Published 2008-12-03 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2008-12-03
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-79

Description

awstats.pl in AWStats 6.8 and earlier does not properly remove quote characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the query_string parameter. NOTE: this issue exists because of an incomplete fix for CVE-2008-3714.

Affected configurations

• awstats awstats (<= 6.8) • awstats awstats 5.0 • awstats awstats 5.1 • awstats awstats 5.2 • awstats awstats 5.3 • awstats awstats 5.4 • awstats awstats 5.5 • awstats awstats 5.6 • awstats awstats 5.7 • awstats awstats 5.8 • awstats awstats 5.9 • awstats awstats 6.0 • awstats awstats 6.1 • awstats awstats 6.2 • awstats awstats 6.3 • awstats awstats 6.4 • awstats awstats 6.5 • awstats awstats 6.6 • awstats awstats 6.7

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

Referenced by CWE · observed example (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References