CVE-2018-10245 — A Full Path Disclosure vulnerability in AWStats through 7.6 allows remote attackers to know where the config file is allocated, obtaining the full path of the server, a similar issue to CVE-2006-3682

Back Back to CVE browser

MEDIUM

A Full Path Disclosure vulnerability in AWStats through 7.6 allows remote attackers to know where the config file is allocated, obtaining the full path of the server, a similar issue to CVE-2006-3682

Published Apr 20, 2018

5.3

MEDIUM

CVSS 3.0

EPSS 1.85%

Description

A Full Path Disclosure vulnerability in AWStats through 7.6 allows remote attackers to know where the config file is allocated, obtaining the full path of the server, a similar issue to CVE-2006-3682. The attack can, for example, use the awstats.pl framename and update parameters.

Affected products

Remediation

No remediation recorded yet.

Metrics

1.85% 0.01852

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.01852

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v5

Table of values (15 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	1.85% (0.01852)	78.36th	v5 (v2026.06.15)
Jun 15, 2026	1.92% (0.01917)	77.13th	v5 (v2026.06.15)
Jul 20, 2024	0.18% (0.00183)	56.01th	v3 (v2023.03.01)
Apr 25, 2024	0.18% (0.00183)	54.99th	v3 (v2023.03.01)
Mar 15, 2024	0.18% (0.00176)	53.74th	v3 (v2023.03.01)
Feb 8, 2024	0.16% (0.00159)	51.22th	v3 (v2023.03.01)
Mar 7, 2023	0.25% (0.00249)	60.93th	v3 (v2023.03.01)
Mar 6, 2023	1.05% (0.01055)	52.13th	v2 (v2022.01.01)
Sep 17, 2022	1.05% (0.01055)	50.47th	v2 (v2022.01.01)
Apr 1, 2022	1.05% (0.01055)	48.43th	v2 (v2022.01.01)
Feb 4, 2022	1.05% (0.01055)	27.52th	v2 (v2022.01.01)
Feb 3, 2022	0.52% (0.00523)	12.55th	v1
Jan 6, 2022	0.52% (0.00523)	12.10th	v1
Sep 1, 2021	0.52% (0.00523)	32.27th	v1
Apr 14, 2021	0.52% (0.00523)	0.00th	v1