CVE

Id
36625  
CVE No.
CVE-2008-6508  
Status
Candidate  
Description
Directory traversal vulnerability in the AuthCheck filter in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to bypass authentication and access the admin interface via a .. (dot dot) in a URI that matches the Exclude-Strings list, as demonstrated by a /setup/setup-/.. sequence in a URI.  
Phase
Assigned (20090323)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
399518 36625 CVE-2008-6508 BUGTRAQ:20081108 [AK-ADV2008-001] Openfire Jabber-Server: Multiple Vulnerabilities (Authentication Bypass, SQL injection, ...)  View
399519 36625 CVE-2008-6508 URL:http://www.securityfocus.com/archive/1/archive/1/498162/100/0/threaded  View
399520 36625 CVE-2008-6508 MILW0RM:7075  View
399521 36625 CVE-2008-6508 URL:http://www.milw0rm.com/exploits/7075  View
399522 36625 CVE-2008-6508 MISC:http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt  View
399523 36625 CVE-2008-6508 MISC:http://www.andreas-kurtz.de/archives/63  View
399524 36625 CVE-2008-6508 CONFIRM:http://www.igniterealtime.org/builds/openfire/docs/latest/changelog.html  View
399525 36625 CVE-2008-6508 CONFIRM:http://www.igniterealtime.org/issues/browse/JM-1489  View
399526 36625 CVE-2008-6508 BID:32189  View
399527 36625 CVE-2008-6508 URL:http://www.securityfocus.com/bid/32189  View
399528 36625 CVE-2008-6508 OSVDB:49663  View
399529 36625 CVE-2008-6508 URL:http://osvdb.org/49663  View
399530 36625 CVE-2008-6508 SECUNIA:32478  View
399531 36625 CVE-2008-6508 URL:http://secunia.com/advisories/32478  View
399532 36625 CVE-2008-6508 VUPEN:ADV-2008-3061  View
399533 36625 CVE-2008-6508 URL:http://www.vupen.com/english/advisories/2008/3061  View
399534 36625 CVE-2008-6508 XF:openfire-authcheckfilter-security-bypass(46488)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
41935 JVNDB-2009-002942 Google Gears の WorkerPool API における同一送信元ポリシーを回避される脆弱性 Google Gears の WorkerPool API には、同一送信元ポリシーおよび allowCrossOrigin 関数のアクセス制限を回避される脆弱性が存在します。 CVE-2008-6512 36625 6.8 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002942.html  View