CVE-2006-2644: Medium severity awstats awstats vulnerability
AWStats 6.5, and possibly other versions, allows remote authenticated users to execute arbitrary code by using the configdir parameter to awstats.pl to upload a configuration file whose name contains shell metacharacters, then access that file using the LogFile directive.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2006-2644?
CVE-2006-2644 is classified as a critical vulnerability due to its potential to allow remote authenticated users to execute arbitrary code.
How do I fix CVE-2006-2644?
To mitigate CVE-2006-2644, users should upgrade to a patched version of AWStats that removes the ability to exploit the configdir parameter.
Who is affected by CVE-2006-2644?
CVE-2006-2644 affects users of AWStats versions 6.4_1-sarge1 and 6.5, specifically those with remote authenticated access.
What types of attacks can CVE-2006-2644 facilitate?
CVE-2006-2644 can facilitate arbitrary code execution attacks, potentially leading to unauthorized access and control of the system.
Is CVE-2006-2644 still a threat today?
While CVE-2006-2644 was disclosed in 2006, its relevance depends on the usage of the affected AWStats versions in current environments.