Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2008-6855: Xigla Absolute News Feed lets attackers gain admin access
CVE-2008-6855 · published 17 years ago
Summary
The Xigla Absolute News Feed (versions 1.0 and possibly 1.5) can be tricked into thinking a user is logged in by sending a specially crafted cookie. This lets a remote attacker skip the login step and obtain full administrative control of the feed. Apply the vendor's update or disable the affected component until a fix is available.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| xigla | absolute_news_feed |
1.0 1.5 cpe:2.3:a:xigla:absolute_news_feed:1.0:*:*:*:*:*:*:* |
Original advisory text
Xigla Software Absolute News Feed 1.0 and possibly 1.5 allows remote attackers to bypass authentication and gain administrative access by setting a certain cookie.
Xigla Software Absolute News Feed 1.0 and possibly 1.5 allows remote attackers to bypass authentication and gain administrative access by setting a certain cookie.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Severity
7.5
High
Type
CWE-287Improper Authentication
Timeline
Published14 Jul 2009
Updated29 Oct 2026
First seen29 Sep 2026
Sources
CVE-2008-6855 · NVD
Track software like this
Free during beta