CVE-2020-35176 Path traversal in n/a
An attacker can read arbitrary configuration files by manipulating the config parameter in AWStats, bypassing intended path restrictions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-35176?
CVE-2020-35176 is a medium-severity path traversal vulnerability in Debian Debian Linux, published on 11 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname (omitting the initial /etc), even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501 and CVE-2020-29600.
Weakness: CWE-22
Which versions are affected by CVE-2020-35176?
It affects 3 products.
Products include Awstats Awstats, Debian Debian Linux, Fedoraproject Fedora.
How do I fix CVE-2020-35176?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-35176 being exploited?
There is no known exploitation of CVE-2020-35176 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2020-35176, DEBIAN-CVE-2020-35176, GHSA-6hh4-7wc7-6vq9, UBUNTU-CVE-2020-35176.