CVE-2017-1000501 Path traversal in n/a
Unauthenticated attackers can achieve remote code execution via path traversal in Awstats web analytics software.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-1000501?
CVE-2017-1000501 is a critical path traversal vulnerability in Debian Debian Linux, published on 3 Jan 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Awstats version 7.6 and earlier is vulnerable to a path traversal flaw in the handling of the "config" and "migrate" parameters resulting in unauthenticated remote code execution.
Weakness: CWE-22
Which versions are affected by CVE-2017-1000501?
It affects 2 products.
Products include Awstats Awstats, Debian Debian Linux.
How do I fix CVE-2017-1000501?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2017-1000501 being exploited?
There is no known exploitation of CVE-2017-1000501 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2017-1000501, DEBIAN-CVE-2017-1000501, DLA-1238-1, DSA-4092-1, GHSA-ph65-4f3r-7fv8, MGASA-2018-0045 and 2 more.