Unscored severity · published Dec 2, 2010
CVE-2009-5020
Open redirect vulnerability in awredir.pl in AWStats before 6.95 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified…
–
CVSS
3.5%
EPSS
No
On KEV
Description
Open redirect vulnerability in awredir.pl in AWStats before 6.95 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.5% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AW
Awstats · Awstats
through 6.9; 1.0; 2.1.; 2.2.3; 2.2.4; 3.0; +23 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-5020
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-5020
awstats.sourceforge.net
http://awstats.sourceforge.net/docs/awstats_changelog.txt
More from Awstats
9.8
CVE-2020-29600
In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc/awstats/awstats.conf format
9.8
CVE-2017-1000501
Awstats version 7.6 and earlier is vulnerable to a path traversal flaw in the handling of the "config" and "migrate" parameters resulting in unauthenticated remote code execution
7.8
CVE-2025-63261
AWStats 8.0 is vulnerable to Command Injection via the open function
6.1
CVE-2022-46391
AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper checks
5.3
CVE-2020-35176
In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname (omitting the initial /etc), even though it was intended to only read a file in the…