Unscored severity · published Mar 23, 2009
CVE-2008-6508
Directory traversal vulnerability in the AuthCheck filter in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to bypass authentication and access the admin…
–
CVSS
83.7%
EPSS
No
On KEV
Description
Directory traversal vulnerability in the AuthCheck filter in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to bypass authentication and access the admin interface via a .. (dot dot) in a URI that matches the Exclude-Strings list, as demonstrated by a /setup/setup-/.. sequence in a URI.
Exploitation
Is it being used?
Exploit prediction (EPSS)83.7% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openfire · Igniterealtime
through 3.6.0a; 2.6.0; 2.6.1; 2.6.2; 3.0.0; 3.0.1; +19 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-6508
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-6508
Exploit
http://osvdb.org/49663
secunia.com
http://secunia.com/advisories/32478
Exploit
http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt
www.andreas-kurtz.de
http://www.andreas-kurtz.de/archives/63
Patch
http://www.igniterealtime.org/builds/openfire/docs/latest/changelog.html
Patch
http://www.igniterealtime.org/issues/browse/JM-1489
More from Openfire
7.5
CVE-2023-32315
Openfire administration console authentication bypass
9.8
CVE-2024-25421
An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to escalate privileges via the ROOM_CACHE component
9.8
CVE-2021-45967
An issue was discovered in Pascom Cloud Phone System before 7.20.x
9.8
CVE-2019-18394
A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests
7.5
CVE-2014-3451
OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows remote attackers to perform unspecified spoofing attacks