CVE-2020-35176

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname (omitting the initial /etc), even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501 and CVE-2020-29600.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Dec 12, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-351775.3HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1.CVE-2020-35185.4A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remCVE-2020-351849.8The official composer docker images before 1.8.3 contain a blank password for a root user. System using the composer docker container deployCVE-2020-351859.8The official ghost docker images before 2.16.1-alpine (Alpine specific) contain a blank password for a root user. System using the ghost docCVE-2020-351869.8The official adminer docker images before 4.7.0-fastcgi contain a blank password for a root user. System using the adminer docker container CVE-2020-351879.8The official telegraf docker images before 1.9.4-alpine (Alpine specific) contain a blank password for a root user. System using the telegraCVE-2020-351899.8The official kong docker images before 1.0.2-alpine (Alpine specific) contain a blank password for a root user. System using the kong dockerCVE-2020-35198.1A vulnerability in a specific REST API method of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attaCVE-2020-351909.8The official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a blank password for a root user. System using thCVE-2020-351919.8The official drupal docker images before 8.5.10-fpm-alpine (Alpine specific) contain a blank password for a root user. System using the drupCVE-2020-351929.8The official vault docker images before 0.11.6 contain a blank password for a root user. System using the vault docker container deployed byCVE-2020-351939.8The official sonarqube docker images before alpine (Alpine specific) contain a blank password for a root user. System using the sonarqube do
CVE-2020-35176: Medium severity, CVSS 5.3 | Vulnix