PT-2009-2747 · Apache · Apache Geronimo Application Server

Marc Schoenefeld

·

Publicado

2009-04-17

·

Atualizado

2022-05-02

·

CVE-2009-0038

CVSS v2.0

4.3

Média

VetorAV:N/AC:M/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions Apache Geronimo Application Server versions 2.1 through 2.1.3
Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the web administration console. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The injection can occur via specific parameters: name, ip, username, or description to the "console/portal/Server/Monitoring" endpoint, or via the PATH INFO to the default URI under "console/portal/".
Recommendations For Apache Geronimo Application Server versions 2.1 through 2.1.3, consider restricting access to the web administration console until a fix is available. As a temporary workaround, avoid using the vulnerable parameters name, ip, username, or description in the "console/portal/Server/Monitoring" endpoint. Additionally, restrict the PATH INFO to the default URI under "console/portal/" to minimize the risk of exploitation.

Exploit

Correção

XSS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2009-0038
GHSA-C372-X57P-6X7V

Produtos afetados

Apache Geronimo Application Server