Vulnerability record · CVE-2008-6722 · published 14 April 2009

CVE-2008-6722: Novell access manager information exposure vulnerability

Novell · Access Manager

Novell Access Manager 3 SP4 does not properly expire X.509 certificate sessions, which allows physically proximate attackers to obtain a logged-in session by using a victim's web-browser process that continues to send the original and valid SSL sessionID, related to inability of Apache Tomcat to clear entries from its SSL cache.

1.9 CVSS 2.0 Low EPSS 0.20% · top 91.4% CWE-200 · Information exposure

1.9CVSS 2.0 base score

0.20%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

10References

16 Jun 2026Last modified by NVD

Description

AV:L/AC:M/Au:N/C:P/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Access Manager Novell

References

Link	Tags
http://osvdb.org/49737
http://secunia.com/advisories/32554	Vendor Advisory
http://www.novell.com/support/viewContent.do?externalId=7001788
http://www.securityfocus.com/bid/32121
http://www.vupen.com/english/advisories/2008/3012	Vendor Advisory
http://osvdb.org/49737
http://secunia.com/advisories/32554	Vendor Advisory
http://www.novell.com/support/viewContent.do?externalId=7001788
http://www.securityfocus.com/bid/32121
http://www.vupen.com/english/advisories/2008/3012	Vendor Advisory

Track CVE-2008-6722 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2010-0284Novell access manager path traversal vulnerabilityDirectory traversal vulnerability in the getEntry method in the PortalModuleInstallManager component in a servlet in nps.jar in the Administration Co…EPSS 6.4%18 Jun 2010 9.0CVE-2007-1309Novell access manager permissions and access controls vulnerabilityNovell Access Management 3 SSLVPN Server allows remote authenticated users to bypass VPN restrictions by making policy.txt read-only, disconnecting, …EPSS 1.8%7 Mar 2007 7.5CVE-2007-3570Novell access manager vulnerabilityThe Linux Access Gateway in Novell Access Manager before 3.0 SP1 Release Candidate 1 (RC1) allows remote attackers to bypass unspecified security con…EPSS 2.3%5 Jul 2007 4.3CVE-2009-4878Novell access manager vulnerabilityUnspecified vulnerability in the Administration Console in Novell Access Manager before 3.1 SP1 allows attackers to access system files via unknown a…EPSS 1.2%26 May 2010 4.3CVE-2009-4879Novell access manager improper authentication vulnerabilityThe Identity Server in Novell Access Manager before 3.1 SP1 allows attackers with disabled Active Directory accounts to authenticate using X.509 auth…EPSS 1.0%26 May 2010 5.9CVE-2025-68686FortiOS symbolic link patch bypass exposes sensitive informationFortiOS contains an information exposure flaw (CWE-200) that lets a remote unauthenticated attacker bypass the patch for the symbolic link persistenc…KEVEPSS 30%analysed10 Feb 2026 7.5CVE-2026-20133Cisco Catalyst SD-WAN Manager insufficient file system restrictions expose dataCisco Catalyst SD-WAN Software has insufficient file system restrictions that let an attacker read sensitive files on the underlying operating system…KEVEPSS 32%analysed25 Feb 2026 7.5CVE-2025-31125Vite dev server improper access control exposes arbitrary filesVite's dev server fails to restrict file access when a request uses the ?inline&import or ?raw?import query patterns, allowing content of files that …KEVEPSS 65%analysed31 Mar 2025

Source: NIST National Vulnerability Database (record CVE-2008-6722), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.