CVE-2008-1106

Akamai Client < 3322 - Authentication Bypass via Referer Header Spoofing

Title source: llm
STIX 2.1

Description

The management interface in Akamai Client (formerly Red Swoosh) 3322 and earlier allows remote attackers to bypass authentication via an HTTP request that contains (1) no Referer header, or (2) a spoofed Referer header that matches an approved domain, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and force the client to download and execute arbitrary files.

References (8)

Core 8
Core References
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/493170/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/42895
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2008/1761/references
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/493169/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1020208
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/3930
Patch, Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/30135

Scores

EPSS 0.0077
EPSS Percentile 51.1%

Details

CWE
CWE-287 CWE-352
Status published
Products (2)
akamai_technologies/client < 3322
red_swoosh/client < 3322
Published Jun 09, 2008
Tracked Since Feb 18, 2026