{"id":"CVE-2008-6508","published":"2009-03-23T19:26:00Z","modified":"2024-08-07T11:34:47Z","title":"Directory traversal vulnerability in the AuthCheck filter in the Admin Console in Openfire 3.6.0a and earlier allows…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"Directory traversal vulnerability in the AuthCheck filter in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to bypass authentication and access the admin interface via a .. (dot dot) in a URI that matches the Exclude-Strings list, as demonstrated by a /setup/setup-/.. sequence in a URI.","provenance":"source","from":"CVE.org"},"summary":{"text":"A directory traversal flaw in the AuthCheck filter of the Admin Console in Openfire 3.6.0a and earlier lets a remote attacker bypass authentication by using a \"..\" sequence in a URI that matches the Exclude-Strings list. An attacker needs only network access to the Admin Console, with no credentials or user interaction, and can reach the admin interface by crafting a request such as one containing a \"/setup/setup-/..\" sequence.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:15:43Z"},"cvss":null,"epss":{"score":0.83664,"percentile":0.99686,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":2,"pulses":[{"name":"Thor Lite Scanner - Cigabuntu (Parrot Version) vs. The Book of Shadows","url":"https://otx.alienvault.com/pulse/666ac558d08da6cfb3ba135b","created":"2024-06-13"},{"name":"Thor-Lite Linux 64 (06.11.24) - enriched a bit more but not 'pruned'","url":"https://otx.alienvault.com/pulse/6668b85065eec626e4766a38","created":"2024-06-11"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://www.exploit-db.com/exploits/7075","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt","tags":["x_refsource_MISC"]},{"url":"http://www.igniterealtime.org/builds/openfire/docs/latest/changelog.html","tags":["x_refsource_CONFIRM"]},{"url":"http://secunia.com/advisories/32478","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://osvdb.org/49663","tags":["vdb-entry","x_refsource_OSVDB"]},{"url":"http://www.andreas-kurtz.de/archives/63","tags":["x_refsource_MISC"]},{"url":"http://www.igniterealtime.org/issues/browse/JM-1489","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/32189","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/46488","tags":["vdb-entry","x_refsource_XF"]},{"url":"http://www.securityfocus.com/archive/1/498162/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"http://www.vupen.com/english/advisories/2008/3061","tags":["vdb-entry","x_refsource_VUPEN"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: remote unauthenticated exploitation of public-facing web admin interface","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows remote attackers to bypass authentication and access the admin interface","start":110,"end":189}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1083","name":"File and Directory Discovery","tactics":["discovery"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: traversal yields access to restricted admin paths","mappingType":"primary_impact","evidence":[{"from":"description","quote":"Directory traversal vulnerability in the AuthCheck filter","start":0,"end":57}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-b804e28bf5894dd4955f","title":"Whitepaper Name Goes","publisher":"trustwave.com","url":"https://www.trustwave.com/hubfs/Web/Library/Documents_pdf/Trustwave_SpiderLabs_2023_Hospitality_Sector_Threat_Landscape.pdf","date":null,"mentions":[{"quote":"▪ Jive Openfire (CVE-2008-6508)","start":42973,"end":43004}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2008-6475","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2008-6475","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":7075,"url":"https://www.exploit-db.com/exploits/7075","title":"Openfire Server 3.6.0a - Authentication Bypass / SQL Injection / Cross-Site Scripting","type":"webapps","platform":"jsp","date":"2008-11-09","verified":true,"provenance":"source"},{"id":19432,"url":"https://www.exploit-db.com/exploits/19432","title":"Openfire Server 3.6.0a - Admin Console Authentication Bypass (Metasploit)","type":"webapps","platform":"jsp","date":"2012-06-28","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2008-11-09"},"metasploit":[{"name":"Openfire Admin Console Authentication Bypass","module":"exploit/multi/http/openfire_auth_bypass","type":"exploit","disclosureDate":"2008-11-10","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/openfire_auth_bypass.rb"}],"first":{"date":"2008-11-09","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/7075"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/7075"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1083"],"provenance":"ai"}],"timeline":[{"date":"2008-11-09","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-7075); later: Metasploit 2008-11-10","url":"https://www.exploit-db.com/exploits/7075","provenance":"source"},{"date":"2009-03-23","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2008-6508","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Exploit-DB","daysToKev":null},"priority":{"score":29.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.94,"detail":"percentile 0.9969"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 2 Exploit-DB entries; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":1.08,"detail":"2 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}