GitHub Advisoryadvisory · Maven

GHSA-678x-xfp4-r92r Apache Geronimo Application Server CSRF vulnerabilities

MEDIUM Published 2022-05-02 Modified 2025-04-09 Official page ↗
Aliases
CVE-2009-0039
Ecosystem
Maven
Packages
org.apache.geronimo.plugins:console
Severity
Moderate
Weaknesses
CWE-352
Reviewed
2022-07-29

Affected packages

• Maven org.apache.geronimo.plugins:console: < 2.1.4 → fixed in 2.1.4

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to hijack the authentication of administrators for requests that (1) change the web administration password, (2) upload applications, and perform unspecified other administrative actions, as demonstrated by (3) a Shutdown request to console/portal//Server/Shutdown.

Related

Alias · CVE (1)

  • CVE-2009-0039 Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References