CVE-2008-6508 EXPLOIT
7.5
HIGH · CVSS 2.0 · EPSS 83.7% (pctl 100)
Patch early
A public exploit exists.
Description
Directory traversal vulnerability in the AuthCheck filter in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to bypass authentication and access the admin interface via a .. (dot dot) in a URI that matches the Exclude-Strings list, as demonstrated by a /setup/setup-/.. sequence in a URI.
Scoring
| CVSS | 7.5 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| EPSS | 83.66% — more likely to be exploited than 100% of all CVEs |
| Weakness | CWE-22 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2009-03-23 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| igniterealtime | openfire |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Openfire Server 3.6.0a - Admin Console Authentication Bypass (Metasploit) | 2012-06-28 |
| exploit-db | Openfire Server 3.6.0a - Authentication Bypass / SQL Injection / Cross-Site Scripting | 2008-11-09 |
References
- http://osvdb.org/49663
- http://secunia.com/advisories/32478
- http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt
- http://www.andreas-kurtz.de/archives/63
- http://www.igniterealtime.org/builds/openfire/docs/latest/changelog.html
- http://www.igniterealtime.org/issues/browse/JM-1489
- http://www.securityfocus.com/archive/1/498162/100/0/threaded
- http://www.securityfocus.com/bid/32189
- http://www.vupen.com/english/advisories/2008/3061
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46488
- https://www.exploit-db.com/exploits/7075
- http://osvdb.org/49663
- http://secunia.com/advisories/32478
- http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt
- http://www.andreas-kurtz.de/archives/63
- http://www.igniterealtime.org/builds/openfire/docs/latest/changelog.html
- http://www.igniterealtime.org/issues/browse/JM-1489
- http://www.securityfocus.com/archive/1/498162/100/0/threaded
- http://www.securityfocus.com/bid/32189
- http://www.vupen.com/english/advisories/2008/3061
→ the Explorer · watch your stack · NVD