GitHub Advisoryadvisory · Maven

GHSA-c372-x57p-6x7v Apache Geronimo Application Server multiple cross-site scripting (XSS) vulnerabilities

MEDIUM Published 2022-05-02 Modified 2024-02-26 Official page ↗
Aliases
CVE-2009-0038
Ecosystem
Maven
Packages
org.apache.geronimo.plugins:console
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2024-02-26

Affected packages

• Maven org.apache.geronimo.plugins:console: >= 2.1.0, < 2.1.4 → fixed in 2.1.4

Description

Multiple cross-site scripting (XSS) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) ip, (3) username, or (4) description parameter to console/portal/Server/Monitoring; or (5) the PATH_INFO to the default URI under console/portal/.

Related

Alias · CVE (1)

  • CVE-2009-0038 Multiple cross-site scripting (XSS) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References