CVE catalog

CVE-2022-46391

awstats: CVE-2022-46391

[CVE catalog]

Severity
High · CVSS 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.71% · Oct 25, 2026

AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper checks.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianawstatssid8.0-5fixed
Debianawstatsforky8.0-5fixed
Debianawstatstrixie7.9-1+deb13u2fixed
Debianawstatsbookworm7.8-3+deb12u2fixed
Ubuntuawstatspro7.4+dfsg-1vulnerable
Ubuntuawstatspro7.4+dfsg-1ubuntu0.1vulnerable
Ubuntuawstatspro7.4+dfsg-1ubuntu0.2vulnerable
Ubuntuawstatspro7.4+dfsg-1ubuntu0.3vulnerable
Ubuntuawstatspro7.4+dfsg-1ubuntu0.4+esm1vulnerable
Ubuntuawstatspro7.4+dfsg-1ubuntu0.4+esm2fixed
Ubuntuawstats18.047.6+dfsg-1vulnerable
Ubuntuawstats18.047.6+dfsg-1ubuntu2vulnerable
Ubuntuawstats18.047.6+dfsg-2vulnerable
Ubuntuawstats18.047.6+dfsg-2ubuntu0.18.04.1vulnerable
Ubuntuawstats18.047.6+dfsg-2ubuntu0.18.04.2fixed
Ubuntuawstats20.047.6+dfsg-2vulnerable
Ubuntuawstats20.047.6+dfsg-2ubuntu0.20.04.1vulnerable
Ubuntuawstats20.047.6+dfsg-2ubuntu0.20.04.2fixed
Ubuntuawstats22.047.8-2vulnerable
Ubuntuawstats22.047.8-2ubuntu0.22.04.1fixed
Ubuntuawstatspro7.4+dfsg-1vulnerable
Ubuntuawstatspro7.4+dfsg-1ubuntu0.1vulnerable
Ubuntuawstatspro7.4+dfsg-1ubuntu0.2vulnerable
Ubuntuawstatspro7.4+dfsg-1ubuntu0.3vulnerable
Ubuntuawstatspro7.4+dfsg-1ubuntu0.4+esm1vulnerable
Ubuntuawstatspro7.4+dfsg-1ubuntu0.4+esm2fixed
Ubuntuawstats18.047.6+dfsg-1vulnerable
Ubuntuawstats18.047.6+dfsg-1ubuntu2vulnerable
Ubuntuawstats18.047.6+dfsg-2vulnerable
Ubuntuawstats18.047.6+dfsg-2ubuntu0.18.04.1vulnerable
Ubuntuawstats18.047.6+dfsg-2ubuntu0.18.04.2fixed
Ubuntuawstats20.047.6+dfsg-2vulnerable
Ubuntuawstats20.047.6+dfsg-2ubuntu0.20.04.1vulnerable
Ubuntuawstats20.047.6+dfsg-2ubuntu0.20.04.2fixed
Ubuntuawstats22.047.8-2vulnerable
Ubuntuawstats22.047.8-2ubuntu0.22.04.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianawstatssourcesid7.8-3not yet assignedNot reported[1025410]
Debianawstatssourceforky7.8-3not yet assignedNot reported[1025410]
Debianawstatssourcetrixie7.8-3not yet assignedNot reported[1025410]
Debianawstatssourcebookworm7.8-3not yet assignedNot reported[1025410]
Ubuntuawstatsdebpro7.4+dfsg-1ubuntu0.4+esm2Not reportedUSN-5899-1Not reported
Ubuntuawstatsdeb18.047.6+dfsg-2ubuntu0.18.04.2Not reportedUSN-5899-1Not reported
Ubuntuawstatsdeb20.047.6+dfsg-2ubuntu0.20.04.2Not reportedUSN-5899-1Not reported
Ubuntuawstatsdeb22.047.8-2ubuntu0.22.04.1Not reportedUSN-5899-1Not reported
Ubuntuawstatsdebpro7.4+dfsg-1ubuntu0.4+esm2Not reportedUBUNTU-CVE-2022-46391Not reported
Ubuntuawstatsdeb18.047.6+dfsg-2ubuntu0.18.04.2Not reportedUBUNTU-CVE-2022-46391Not reported
Ubuntuawstatsdeb20.047.6+dfsg-2ubuntu0.20.04.2Not reportedUBUNTU-CVE-2022-46391Not reported
Ubuntuawstatsdeb22.047.8-2ubuntu0.22.04.1Not reportedUBUNTU-CVE-2022-46391Not reported

[Debian bug #1025410]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [awstats]Fixed
    Details (2)

    • 7.8-3+deb12u2 · all · bookworm

      Fixed · Fixed: 7.8-3

      dsa · awstats · debian · bookworm

    • 7.8-3+deb12u2 · all · bookworm

      Fixed · Fixed: 7.8-3

      dsa · awstats · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]