{"id":"CVE-2020-35176","published":"2020-12-11T23:16:22Z","modified":"2024-08-04T17:02:06Z","title":"In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname (omitting the initial /etc)…","vendor":null,"product":null,"tier":"tail","description":{"text":"In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname (omitting the initial /etc), even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501 and CVE-2020-29600.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.02175,"percentile":0.82257,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/eldy/awstats/issues/195","tags":["x_refsource_MISC"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/12/msg00035.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRHYCKLW5VPM6KP2WZW6DCCVHVBG7YCW/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/47QZWKSRZYZFESYTLSW7A6KVKOOPL7IV/","tags":["vendor-advisory","x_refsource_FEDORA"]}],"priority":{"score":16.5,"factors":[{"name":"EPSS percentile","points":16.45}]},"euvd":{"id":"EUVD-2020-22864","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-cve-2017-1000501-family-cve-2017-1000501","parents":[{"from":"CVE-2017-1000501","to":"CVE-2020-35176","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501 and CVE-2020-29600.","from":"CVE.org","in":"CVE-2020-35176"}]},{"from":"CVE-2020-29600","to":"CVE-2020-35176","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501 and CVE-2020-29600.","from":"CVE.org","in":"CVE-2020-35176"}]}]}}