PT-2009-1292 · Apache · Apache Geronimo Application Server
Published
2009-04-17
·
Updated
2022-05-14
·
CVE-2008-5518
CVSS v2.0
9.4
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
Apache Geronimo Application Server versions 2.1 through 2.1.3
Description
The issue concerns multiple directory traversal vulnerabilities in the web administration console. These vulnerabilities allow remote attackers to upload files to arbitrary directories via directory traversal sequences in various parameters, including the
group, artifact, version, or fileType parameter to the "console/portal//Services/Repository" endpoint, the createDB parameter to the "console/portal/Embedded DB/DB Manager" endpoint, or the filename parameter to the createKeystore script in the Security/Keystores portlet.Recommendations
For Apache Geronimo Application Server versions 2.1 through 2.1.3, consider restricting access to the vulnerable parameters, such as
group, artifact, version, fileType, createDB, and filename, in the respective endpoints until a patch is available. As a temporary workaround, avoid using these parameters in the affected API endpoints and portlets.Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Apache Geronimo Application Server