CVE-2008-3708

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Multiple directory traversal vulnerabilities in dotCMS 1.6.0.9 allow remote attackers to read arbitrary files via a .. (dot dot) in the id parameter to (1) news/index.dot and (2) getting_started/macros/macros_detail.dot.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Aug 19, 2008
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2008

CVE-2008-37094.3Multiple cross-site scripting (XSS) vulnerabilities in CyBoards PHP Lite 1.21 allow remote attackers to inject arbitrary web script or HTML CVE-2008-37105.1Multiple directory traversal vulnerabilities in CyBoards PHP Lite 1.21 allow remote attackers to include and execute arbitrary local files vCVE-2008-37117.5SQL injection vulnerability in index.php in PHPArcadeScript (PHP Arcade Script) 4.0 allows remote attackers to execute arbitrary SQL commandCVE-2008-37122.6Multiple cross-site scripting (XSS) vulnerabilities in Mambo 4.6.2 and 4.6.5, when register_globals is enabled, allow remote attackers to inCVE-2008-37137.5SQL injection vulnerability in product.php in PHPBasket allows remote attackers to execute arbitrary SQL commands via the pro_id parameter.CVE-2008-37144.3Cross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.8 allows remote attackers to inject arbitrary web script or HTML via theCVE-2008-37152.6Cross-site scripting (XSS) vulnerability in inc-core-admin-editor-previouscolorsjs.php in the FlexCMS 2.5 and earlier, when register_globalsCVE-2008-37166.0Cross-site request forgery (CSRF) vulnerability in Harmoni before 1.6.0 allows remote attackers to make administrative modifications via a (CVE-2008-37175.0Harmoni before 1.6.0 does not require administrative privileges to list (1) user names or (2) asset ids, which allows remote attackers to obCVE-2008-37186.5Multiple SQL injection vulnerabilities in cyberBB 0.6 allow remote authenticated users to execute arbitrary SQL commands via the (1) id paraCVE-2008-37197.5SQL injection vulnerability in directory.php in SFS Affiliate Directory allows remote attackers to execute arbitrary SQL commands via the idCVE-2008-37207.5SQL injection vulnerability in index.php in DeeEmm CMS (DMCMS) 0.7.4 allows remote attackers to execute arbitrary SQL commands via the page
CVE-2008-3708: Medium severity, CVSS 4.3 | Vulnix