CVE-2018-10245 Information disclosure in n/a

Medium 5.3 Published 20 Apr 2018 Updated 16 Sep 2024

Remote attackers can obtain the full server path of the configuration file via specific parameters, exposing internal directory structures.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-10245?

CVE-2018-10245 is a medium-severity vulnerability in n/a, published on 20 Apr 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A Full Path Disclosure vulnerability in AWStats through 7.6 allows remote attackers to know where the config file is allocated, obtaining the full path of the server, a similar issue to CVE-2006-3682. The attack can, for example, use the awstats.pl framename and update parameters.

Weakness: CWE-200

Which versions are affected by CVE-2018-10245?

It affects 1 product.

Products include Awstats Awstats.

How do I fix CVE-2018-10245?

No fix has been published for CVE-2018-10245 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-10245 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-10245 exists.

Public exploit code: 1 Nuclei template.

Sources

Also known as DEBIAN-CVE-2018-10245, GHSA-ccww-jx9f-9pm9, UBUNTU-CVE-2018-10245.