CVE-2008-1106

Severity: high (CVSS 7.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-06-09 · updated 2026-06-16
Weakness: CWE-287

Description

The management interface in Akamai Client (formerly Red Swoosh) 3322 and earlier allows remote attackers to bypass authentication via an HTTP request that contains (1) no Referer header, or (2) a spoofed Referer header that matches an approved domain, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and force the client to download and execute arbitrary files.

Affected products

Akamai Technologies Client: through 3322
Red Swoosh Client: through 3322

References

http://secunia.com/advisories/30135
http://secunia.com/secunia_research/2008-19/advisory/
http://securityreason.com/securityalert/3930
http://www.securityfocus.com/archive/1/493169/100/0/threaded
http://www.securityfocus.com/archive/1/493170/100/0/threaded
http://www.securitytracker.com/id?1020208
http://www.vupen.com/english/advisories/2008/1761/references
https://exchange.xforce.ibmcloud.com/vulnerabilities/42895
http://secunia.com/advisories/30135
http://secunia.com/secunia_research/2008-19/advisory/
http://securityreason.com/securityalert/3930
http://www.securityfocus.com/archive/1/493169/100/0/threaded

Get alerted when CVE-2008-1106 or the next vulnerability affects your stack