Unscored severity · published Mar 23, 2009
CVE-2008-6511
Open redirect vulnerability in login.jsp in Openfire 3.6.0a and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the url…
–
CVSS
1.8%
EPSS
No
On KEV
Description
Open redirect vulnerability in login.jsp in Openfire 3.6.0a and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the url parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openfire · Igniterealtime
through 3.6.0a; 2.6.0; 2.6.1; 2.6.2; 3.0.0; 3.0.1; +19 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-6511
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-6511
Exploit
http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt
www.securityfocus.com
http://www.securityfocus.com/archive/1/498162/100/0/threaded
www.exploit-db.com
https://www.exploit-db.com/exploits/7075
More from Openfire
7.5
CVE-2023-32315
Openfire administration console authentication bypass
9.8
CVE-2024-25421
An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to escalate privileges via the ROOM_CACHE component
9.8
CVE-2021-45967
An issue was discovered in Pascom Cloud Phone System before 7.20.x
9.8
CVE-2019-18394
A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests
7.5
CVE-2014-3451
OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows remote attackers to perform unspecified spoofing attacks