CVE-2022-46391: XSS
AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper checks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/awstatsto a version that resolves this vulnerability.Fixed in 7.8-3+deb12u2Fixed in 7.9-1+deb13u2Fixed in 8.0-5 - Upgrade
Upgrade
alpine/awstatsto a version that resolves this vulnerability.Fixed in 7.8-r3 - Upgrade
Upgrade
alpine/awstatsto a version that resolves this vulnerability.Fixed in 7.9-r0 - Upgrade
Upgrade
debian/awstatsto a version that resolves this vulnerability.Fixed in 7.8-3
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2022-46391.
What is the severity of CVE-2022-46391?
The severity of CVE-2022-46391 is medium.
What software versions are affected by CVE-2022-46391?
AWStats 7.x through 7.8, Debian Linux 10.0, Fedora 36, and Fedora 37 are affected by CVE-2022-46391.
What is the CWE ID for CVE-2022-46391?
The CWE ID for CVE-2022-46391 is CWE-79.
How can I fix CVE-2022-46391?
To fix CVE-2022-46391, update to the latest version of AWStats and apply any available patches or security updates for your operating system.