CVE-2009-0038 - Multiple cross-site scripting (XSS) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) ip, (3) username, or (4) description parameter to console/portal/Server/Monitoring; or (5) the PATH_INFO to the default URI under console/portal/

Back Back to CVE browser

MEDIUM

Multiple cross-site scripting (XSS) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) ip, (3) username, or (4) description parameter to console/portal/Server/Monitoring; or (5) the PATH_INFO to the default URI under console/portal/

Published Apr 17, 2009

4.3

MEDIUM

CVSS 2.0

EPSS 18.00%

Description

Multiple cross-site scripting (XSS) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) ip, (3) username, or (4) description parameter to console/portal/Server/Monitoring; or (5) the PATH_INFO to the default URI under console/portal/.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (14)

http://dsecrg.com/pages/vul/show.php?id=119
x_refsource_MISCExploit
http://geronimo.apache.org/21x-security-report.html#2.1.xSecurityReport-214
x_refsource_CONFIRMPatchVendor Advisory
http://issues.apache.org/jira/browse/GERONIMO-4597
x_refsource_CONFIRMPatch
http://secunia.com/advisories/34715
third-party-advisoryx_refsource_SECUNIA
http://www.securityfocus.com/archive/1/502734/100/0/threaded
mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/34562
vdb-entryx_refsource_BIDExploit
http://www.vupen.com/english/advisories/2009/1089
vdb-entryx_refsource_VUPEN
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3484
Advisory
https://github.com/advisories/GHSA-c372-x57p-6x7v
Advisory
https://github.com/apache/geronimo/commit/aa0c2c26dde8930cad924796af7c17a13d236b16
https://nvd.nist.gov/vuln/detail/CVE-2009-0038
https://web.archive.org/web/20090419162753/http://secunia.com/advisories/34715
https://web.archive.org/web/20090422192202/http://dsecrg.com/pages/vul/show.php?id=119
https://web.archive.org/web/20200229223125/http://www.securityfocus.com/bid/34562

Link	Providers	Tags
http://dsecrg.com/pages/vul/show.php?id=119		x_refsource_MISCExploit
http://geronimo.apache.org/21x-security-report.html#2.1.xSecurityReport-214		x_refsource_CONFIRMPatchVendor Advisory
http://issues.apache.org/jira/browse/GERONIMO-4597		x_refsource_CONFIRMPatch
http://secunia.com/advisories/34715		third-party-advisoryx_refsource_SECUNIA
http://www.securityfocus.com/archive/1/502734/100/0/threaded		mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/34562		vdb-entryx_refsource_BIDExploit
http://www.vupen.com/english/advisories/2009/1089		vdb-entryx_refsource_VUPEN
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3484		Advisory
https://github.com/advisories/GHSA-c372-x57p-6x7v		Advisory
https://github.com/apache/geronimo/commit/aa0c2c26dde8930cad924796af7c17a13d236b16
https://nvd.nist.gov/vuln/detail/CVE-2009-0038
https://web.archive.org/web/20090419162753/http://secunia.com/advisories/34715
https://web.archive.org/web/20090422192202/http://dsecrg.com/pages/vul/show.php?id=119
https://web.archive.org/web/20200229223125/http://www.securityfocus.com/bid/34562