GitHub Advisoryadvisory · Maven

GHSA-2jxh-3cx8-xw65 Apache Geronimo console 1.0 vulnerable to cross-site scripting

MEDIUM Published 2022-05-01 Modified 2022-07-28 Official page ↗
Aliases
CVE-2006-0254
Ecosystem
Maven
Packages
geronimo:geronimo-console-standard
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2022-07-28

Affected packages

• Maven geronimo:geronimo-console-standard: < 1.1 → fixed in 1.1

Description

Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer. Version 1.1 contains fixes for these issues.

Related

Alias · CVE (1)

  • CVE-2006-0254 Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References