CVE-2008-6508 Directory traversal vulnerability in the AuthCheck filter in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to bypass authentication and access the admin interface via a .. (...
HighCVSS 7.5
EPSS 83.7%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Directory traversal vulnerability in the AuthCheck filter in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to bypass authentication and access the admin interface via a .. (dot dot) in a URI that matches the Exclude-Strings list, as demonstrated by a /setup/setup-/.. sequence in a URI.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| igniterealtime openfire | <= 3.6.0a | No fix listed |
| igniterealtime openfire | = 2.6.0 | No fix listed |
| igniterealtime openfire | = 2.6.1 | No fix listed |
| igniterealtime openfire | = 2.6.2 | No fix listed |
| igniterealtime openfire | = 3.0.0 | No fix listed |
| igniterealtime openfire | = 3.0.1 | No fix listed |
| igniterealtime openfire | = 3.1.0 | No fix listed |
| igniterealtime openfire | = 3.1.1 | No fix listed |
| igniterealtime openfire | = 3.2.0 | No fix listed |
| igniterealtime openfire | = 3.2.1 | No fix listed |
| igniterealtime openfire | = 3.2.2 | No fix listed |
| igniterealtime openfire | = 3.2.3 | No fix listed |
| igniterealtime openfire | = 3.2.4 | No fix listed |
| igniterealtime openfire | = 3.3.0 | No fix listed |
| igniterealtime openfire | = 3.3.2 | No fix listed |
| igniterealtime openfire | = 3.3.3 | No fix listed |
| igniterealtime openfire | = 3.4.0 | No fix listed |
| igniterealtime openfire | = 3.4.1 | No fix listed |
| igniterealtime openfire | = 3.4.3 | No fix listed |
| igniterealtime openfire | = 3.4.4 | No fix listed |
| igniterealtime openfire | = 3.4.5 | No fix listed |
| igniterealtime openfire | = 3.5.0 | No fix listed |
| igniterealtime openfire | = 3.5.1 | No fix listed |
| igniterealtime openfire | = 3.5.2 | No fix listed |
| igniterealtime openfire | = 3.6.0 | No fix listed |
References
- 49663 exploit vdb-entry
- 32478 third-party-advisory
- www.andreas-kurtz.de exploit
- www.andreas-kurtz.de
- www.igniterealtime.org patch vendor-advisory
- www.igniterealtime.org patch vendor-advisory
- 20081108 [AK-ADV2008-001] Openfire Jabber-Server: Multiple Vulnerabilities (Authentication Bypass, SQL injection, ...) mailing-list
- 32189 exploit vdb-entry
- ADV-2008-3061 vdb-entry vendor-advisory
- openfire-authcheckfilter-security-bypass(46488) vdb-entry
- 7075 exploit