Published: 23/03/2009 Updated: 11/10/2018

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 760

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Directory traversal vulnerability in the AuthCheck filter in the Admin Console in Openfire 3.6.0a and previous versions allows remote malicious users to bypass authentication and access the admin interface via a .. (dot dot) in a URI that matches the Exclude-Strings list, as demonstrated by a /setup/setup-/.. sequence in a URI.

Vulnerable Product	Search on Vulmon	Subscribe to Product
igniterealtime openfire 2.6.2
igniterealtime openfire 3.0.0
igniterealtime openfire 3.2.3
igniterealtime openfire 3.2.4
igniterealtime openfire 3.4.4
igniterealtime openfire 3.4.5
igniterealtime openfire 3.1.1
igniterealtime openfire 3.2.0
igniterealtime openfire 3.3.3
igniterealtime openfire 3.4.0
igniterealtime openfire 3.6.0
igniterealtime openfire
igniterealtime openfire 2.6.1
igniterealtime openfire 2.6.0
igniterealtime openfire 3.2.1
igniterealtime openfire 3.2.2
igniterealtime openfire 3.4.1
igniterealtime openfire 3.4.3
igniterealtime openfire 3.0.1
igniterealtime openfire 3.1.0
igniterealtime openfire 3.3.0
igniterealtime openfire 3.3.2
igniterealtime openfire 3.5.0
igniterealtime openfire 3.5.1
igniterealtime openfire 3.5.2

This Metasploit module exploits an authentication bypass vulnerability in the administration console of Openfire servers By using this vulnerability it is possible to upload/execute a malicious Openfire plugin on the server and execute arbitrary Java code This Metasploit module has been tested against Openfire 360a It is possible to remove the ...

## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions Please see the Metasploit # Framework web site for more information on licensing and terms of use # metasploitcom/framework/ ## require 'msf/core' require 'rex/zip' class Metasploit3 < Msf::Exploit::Remote Rank = E ...

Advisory: Openfire Server Multiple Vulnerabilities Advisory ID: AKADV2008-001 Release Date: 2008/11/07 Revision: 10 Last Modified: 2008/11/07 Date Reported: 2008/05/17 Author: Andreas Kurtz (mail at andreas-kurtzde) Affected Software: Openfire Server <= 36 ...

CWE-22 http://www.igniterealtime.org/issues/browse/JM-1489 http://www.vupen.com/english/advisories/2008/3061 http://www.igniterealtime.org/builds/openfire/docs/latest/changelog.html http://osvdb.org/49663 http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt http://www.securityfocus.com/bid/32189 http://www.andreas-kurtz.de/archives/63 http://secunia.com/advisories/32478 https://exchange.xforce.ibmcloud.com/vulnerabilities/46488 https://www.exploit-db.com/exploits/7075 http://www.securityfocus.com/archive/1/498162/100/0/threaded https://nvd.nist.gov https://packetstormsecurity.com/files/114326/Openfire-Admin-Console-Authentication-Bypass.html https://www.exploit-db.com/exploits/19432/

CVE-2008-6508

Vulnerability Summary

Vulnerability Trend

Exploits

References

Vulmon Search

About

Products

Connect