CVE-2022-46391
AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net:...
AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper checks.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper checks.
- Record
CVE-2022-46391- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List
AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper checks.
- Record
CVE-2022-46391- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2022-49200
AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper checks.
- Record
EUVD-2022-49200- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-j6xf-hwqw-qjg4
AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net:...
AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper checks.
- Record
GHSA-j6xf-hwqw-qjg4- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVALPINE-CVE-2022-46391
AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper checks.
- Record
ALPINE-CVE-2022-46391- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-03
OSV
AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper checks.
- Record
CVE-2022-46391- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2022-46391
AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper checks.
- Record
UBUNTU-CVE-2022-46391- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-46391 No score
AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper checks.
- Record
DEBIAN-CVE-2022-46391- Updated
- 2026-11-03
OSVMGASA-2022-0461 No score
Updated awstats packages fix security vulnerability
AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper checks. (CVE-2022-46391)
- Record
MGASA-2022-0461- Updated
- 2026-11-02
OSVUSN-5899-1 No score
awstats vulnerability
It was discovered that AWStats did not properly sanitize the content of whois responses in the hostinfo plugin. An attacker could possibly use this issue to conduct cross-site scripting (XSS) attacks.
- Record
USN-5899-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
awstatsAlpine:v3.17 |
7.0 up to 7.8-r3 | 7.8-r3 |
awstatsAlpine:v3.18 |
7.0 up to 7.9-r0 | 7.9-r0 |
awstatsAlpine:v3.19 |
7.0 up to 7.9-r0 | 7.9-r0 |
awstatsAlpine:v3.20 |
7.0 up to 7.9-r0 | 7.9-r0 |
awstatsAlpine:v3.21 |
7.0 up to 7.9-r0 | 7.9-r0 |
awstatsAlpine:v3.22 |
7.0 up to 7.9-r0 | 7.9-r0 |
awstatsAlpine:v3.23 |
7.0 up to 7.9-r0 | 7.9-r0 |
awstatsAlpine:v3.24 |
7.0 up to 7.9-r0 | 7.9-r0 |
awstatsDebian:12 |
before 7.8-3 | 7.8-3 |
awstatsDebian:13 |
before 7.8-3 | 7.8-3 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
awstatsDebian:14 |
before 7.8-3 | 7.8-3 |
awstatsDebian:10 |
before 7.6+dfsg-2+deb10u2, plus listed versions 7.6+dfsg-27.6+dfsg-2+deb10u1 |
7.6+dfsg-2+deb10u2 |
awstatsMageia:8 |
before 7.8-2.1.mga8 | 7.8-2.1.mga8 |
awstatsUbuntu:Pro:16.04:LTS |
before 7.4+dfsg-1ubuntu0.4+esm2, plus listed versions 7.4+dfsg-17.4+dfsg-1ubuntu0.17.4+dfsg-1ubuntu0.27.4+dfsg-1ubuntu0.37.4+dfsg-1ubuntu0.4+esm1 |
7.4+dfsg-1ubuntu0.4+esm2 |
awstatsUbuntu:18.04:LTS |
before 7.6+dfsg-2ubuntu0.18.04.2, plus listed versions 7.6+dfsg-17.6+dfsg-1ubuntu27.6+dfsg-27.6+dfsg-2ubuntu0.18.04.1 |
7.6+dfsg-2ubuntu0.18.04.2 |
awstatsUbuntu:20.04:LTS |
before 7.6+dfsg-2ubuntu0.20.04.2, plus listed versions 7.6+dfsg-27.6+dfsg-2ubuntu0.20.04.1 |
7.6+dfsg-2ubuntu0.20.04.2 |
awstatsUbuntu:22.04:LTS |
before 7.8-2ubuntu0.22.04.1, plus listed versions 7.8-2 |
7.8-2ubuntu0.22.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-46391 is a medium vulnerability (CVSS 6.1) in Awstats, published December 4, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.71%, the 53rd percentile. Fixed in awstats 7.8-r3.
References
github.com/eldy/AWStats/pull/226
lists.debian.org/debian-lts-announce/2022/12/msg00010.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GRFYH4DE3COMI3LJCOQQXA4FWOABU6Z2
nvd.nist.gov/vuln/detail/CVE-2022-46391
Show 11 moreShow less
security.alpinelinux.org/vuln/CVE-2022-46391
security-tracker.debian.org/tracker/CVE-2022-46391
advisories.mageia.org/MGASA-2022-0461.html
bugs.mageia.org/show_bug.cgi?id=31230
debian.org/lts/security/2022/dla-3225
ubuntu.com/security/CVE-2022-46391
cve.org/CVERecord?id=CVE-2022-46391