GHSA-c372-x57p-6x7v

Apache Geronimo Application Server multiple cross-site scripting (XSS) vulnerabilities

Source: GitHub Advisory Database (reviewed) Moderate CVE-2009-0038

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.apache.geronimo.plugins:console	>= 2.1.0, < 2.1.4	2.1.4

Details

As written in the advisory (Markdown source, shown as plain text).

Multiple cross-site scripting (XSS) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) ip, (3) username, or (4) description parameter to console/portal/Server/Monitoring; or (5) the PATH_INFO to the default URI under console/portal/.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2009-0038 advisory
https://github.com/apache/geronimo/commit/aa0c2c26dde8930cad924796af7c17a13d236b16 web
https://github.com/apache/geronimo package
https://web.archive.org/web/20090419162753/http://secunia.com/advisories/34715 web
https://web.archive.org/web/20090422192202/http://dsecrg.com/pages/vul/show.php?id=119 web
https://web.archive.org/web/20200229223125/http://www.securityfocus.com/bid/34562 web
http://geronimo.apache.org/21x-security-report.html#2.1.xSecurityReport-214 web
http://issues.apache.org/jira/browse/GERONIMO-4597 web