CVEvulnerability
CVE-2009-0038
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2009-04-17
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Multiple cross-site scripting (XSS) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) ip, (3) username, or (4) description parameter to console/portal/Server/Monitoring; or (5) the PATH_INFO to the default URI under console/portal/.
Affected configurations
• apache geronimo 2.1
• apache geronimo 2.1.1
• apache geronimo 2.1.2
• apache geronimo 2.1.3
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://dsecrg.com/pages/vul/show.php?id=119 Exploit
- http://geronimo.apache.org/21x-security-report.html#2.1.xSecurityReport-214 Patch, Vendor Advisory
- http://issues.apache.org/jira/browse/GERONIMO-4597 Patch
- http://secunia.com/advisories/34715 secunia.com
- http://www.securityfocus.com/archive/1/502734/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/34562 Exploit
- http://www.vupen.com/english/advisories/2009/1089 www.vupen.com
- http://dsecrg.com/pages/vul/show.php?id=119 Exploit
- http://geronimo.apache.org/21x-security-report.html#2.1.xSecurityReport-214 Patch, Vendor Advisory
- http://issues.apache.org/jira/browse/GERONIMO-4597 Patch
- http://secunia.com/advisories/34715 secunia.com
- http://www.securityfocus.com/archive/1/502734/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/34562 Exploit
- http://www.vupen.com/english/advisories/2009/1089 www.vupen.com