Evil-DB LogoEvil-DB
← All CVEs

CVE-2008-6508

high · 7.5

Directory traversal vulnerability in the AuthCheck filter in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to bypass authentication and access the admin interface via a .. (dot dot) in a URI that matches the Exclude-Strings list, as demonstrated by a /setup/setup-/.. sequence in a URI.

7.5
CVSS
83.4%
EPSS (exploit prob.)
100th
EPSS percentile
2009-03-23
Published

AV:N/AC:L/Au:N/C:P/I:P/A:P

Weaknesses

CWE-22

Affected products

VendorProductAffected versions
igniterealtimeopenfire<= 3.6.0a
igniterealtimeopenfire2.6.0
igniterealtimeopenfire2.6.1
igniterealtimeopenfire2.6.2
igniterealtimeopenfire3.0.0
igniterealtimeopenfire3.0.1
igniterealtimeopenfire3.1.0
igniterealtimeopenfire3.1.1
igniterealtimeopenfire3.2.0
igniterealtimeopenfire3.2.1
igniterealtimeopenfire3.2.2
igniterealtimeopenfire3.2.3
igniterealtimeopenfire3.2.4
igniterealtimeopenfire3.3.0
igniterealtimeopenfire3.3.2
igniterealtimeopenfire3.3.3
igniterealtimeopenfire3.4.0
igniterealtimeopenfire3.4.1
igniterealtimeopenfire3.4.3
igniterealtimeopenfire3.4.4
igniterealtimeopenfire3.4.5
igniterealtimeopenfire3.5.0
igniterealtimeopenfire3.5.1
igniterealtimeopenfire3.5.2
igniterealtimeopenfire3.6.0

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2008-6508