CVEvulnerability
CVE-2008-1106
7.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2008-06-09
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.1 HIGH — AV:N/AC:M/Au:N/C:N/I:C/A:N
- Weaknesses
- CWE-287, CWE-352
Description
The management interface in Akamai Client (formerly Red Swoosh) 3322 and earlier allows remote attackers to bypass authentication via an HTTP request that contains (1) no Referer header, or (2) a spoofed Referer header that matches an approved domain, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and force the client to download and execute arbitrary files.
Affected configurations
• akamai technologies client (<= 3322)
• red swoosh client (<= 3322)
Related
References
- http://secunia.com/advisories/30135 Patch, Vendor Advisory
- http://secunia.com/secunia_research/2008-19/advisory/ Vendor Advisory
- http://securityreason.com/securityalert/3930 securityreason.com
- http://www.securityfocus.com/archive/1/493169/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/archive/1/493170/100/0/threaded www.securityfocus.com
- http://www.securitytracker.com/id?1020208 www.securitytracker.com
- http://www.vupen.com/english/advisories/2008/1761/references www.vupen.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42895 exchange.xforce.ibmcloud.com
- http://secunia.com/advisories/30135 Patch, Vendor Advisory
- http://secunia.com/secunia_research/2008-19/advisory/ Vendor Advisory
- http://securityreason.com/securityalert/3930 securityreason.com
- http://www.securityfocus.com/archive/1/493169/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/archive/1/493170/100/0/threaded www.securityfocus.com
- http://www.securitytracker.com/id?1020208 www.securitytracker.com
- http://www.vupen.com/english/advisories/2008/1761/references www.vupen.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42895 exchange.xforce.ibmcloud.com