« Volver al listado

CVE-2008-3922

Estado: ModificadaAlta (9.3)—

awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences in the sort parameter, which is used by the multisort function when dynamically creating an anonymous PHP function.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Telartis BV — Awstats Totals

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2008-3922",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": true,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2008-09-04T18:41:00.000",
  "references": [
    {
      "url": "http://secunia.com/advisories/31630",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securityreason.com/securityalert/4218",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securityreason.com/securityalert/8259",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://userwww.service.emory.edu/~ekenda2/EMORY-2008-01.txt",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.exploit-db.com/exploits/17324",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/495770/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/30856",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.telartis.nl/xcms/awstats/",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/2442",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44712",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.exploit-db.com/exploits/6368",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/31630",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securityreason.com/securityalert/4218",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securityreason.com/securityalert/8259",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://userwww.service.emory.edu/~ekenda2/EMORY-2008-01.txt",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.exploit-db.com/exploits/17324",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/495770/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/30856",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.telartis.nl/xcms/awstats/",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/2442",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44712",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/6368",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences in the sort parameter, which is used by the multisort function when dynamically creating an anonymous PHP function."
    },
    {
      "lang": "es",
      "value": "awstatstotals.php de AWStats Totals 1.0 hasta 1.14, permite a atacantes remotos ejecutar código de su elección a través de secuencias PHP en el parámetro sort que se emplea en la función multisort cuando de forma dinámica se crea una función PHP anónima."
    }
  ],
  "lastModified": "2026-06-16T22:56:49.300",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:telartis_bv:awstats_totals:1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EB4AC543-C314-40F1-9DE7-80BC7CE8CFD2"
            },
            {
              "criteria": "cpe:2.3:a:telartis_bv:awstats_totals:1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "333F1513-9A70-4688-99A4-A9762D601AAE"
            },
            {
              "criteria": "cpe:2.3:a:telartis_bv:awstats_totals:1.11:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "51AEF1B6-8C0A-4887-A627-2EE3B533216F"
            },
            {
              "criteria": "cpe:2.3:a:telartis_bv:awstats_totals:1.13:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "567AC813-9B48-41CE-B289-E2ACB6AE5EA7"
            },
            {
              "criteria": "cpe:2.3:a:telartis_bv:awstats_totals:1.14:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9A3E6A6E-668B-463D-BCF3-45A86D7F5ACE"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}