Security Test: AWStats Config Exposure¶

Description¶

Default Severity: high

AWStats config exposure happens when the settings file for AWStats is left open to the public. This file can reveal sensitive data like paths, credentials, or details about the server setup, which attackers can use to plan further attacks. The problem usually arises from misconfigurations or leaving default files in places where they’re accessible on the web. Developers might often overlook proper file permissions or assume default settings are secure, making it easier for attackers to exploit. If not fixed, it can expose your system to significant risks, including unauthorized access and further breaches.

Configuration¶

Identifier: information_disclosure/awstats_config_exposure

Examples¶

All configuration available:

checks:
  information_disclosure/awstats_config_exposure:
    skip: false # default

Compliance and Standards¶