CVE-2008-6508
Directory traversal vulnerability in the AuthCheck filter in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to bypass authentication and access the admin interface via a .. (dot dot) in a URI that matches the Exclude-Strings list, as demonstrated by a /setup/setup-/.. sequence in a URI.
- Affected products
- Openfire
- Igniterealtime Openfire
- ≤ 3.6.0a, 2.6.0, 2.6.1, 2.6.2, 3.0.0, 3.0.1, 3.1.0, 3.1.1, 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.3.0, 3.3.2, 3.3.3, 3.4.0, 3.4.1, 3.4.3, 3.4.4, 3.4.5, 3.5.0, 3.5.1, 3.5.2, 3.6.0
- CVSS 2.0
- 7.5 HIGH
- EPSS
- 83.4% (100th percentile)
- Weakness
- CWE-22
- NVD status
- Modified
- Published
- 2009-03-23
CVE-2008-6508 at NVD
5 known exploits for CVE-2008-6508
Proof-of-concept code and exploit modules indexed by Sploitus
Openfire <= 3.6.0a Admin Console Authentication Bypass
Openfire Admin Console Authentication Bypass
Openfire Server 3.6.0a - Admin Console Authentication Bypass (Metasploit)
Openfire Admin Console Authentication Bypass
Openfire Server 3.6.0a - Authentication Bypass / SQL Injection / Cross-Site Scripting