CVE-2009-0038 Apache Geronimo Application Server multiple cross-site scripting (XSS) vulnerabilities

What is CVE-2009-0038?

CVE-2009-0038 is a medium-severity cross-site scripting vulnerability in n/a, published on 17 Apr 2009. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

Multiple cross-site scripting (XSS) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) ip, (3) username, or (4) description parameter to console/portal/Server/Monitoring; or (5) the PATH_INFO to the default URI under console/portal/.

Weakness: CWE-79

Which versions are affected by CVE-2009-0038?

2 open source packages ship an affected version, including org.apache.geronimo.plugins:console. It affects 1 product.

Products include Apache Geronimo.

How do I fix CVE-2009-0038?

Upgrade org.apache.geronimo.plugins:console to 2.1.4 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2009-0038 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2009-0038 exists.

Public exploit code: 2 Exploit-DB entries.

Other vulnerabilities in n/a

• CVE-2013-1777 Apache Geronimo JMX Remoting functionality allows remote code execution in 3.x before v3.0.1 Critical 10.0
• CVE-2007-4548 Auth bypass in n/a Critical 10.0
• CVE-2008-5518 Apache Geronimo Application Server multiple directory traversal vulnerabilities Critical 9.4
• CVE-2011-5034 Apache Geronimo Hash Collisions Cause DoS High 7.8
• CVE-2007-5797 Auth bypass in n/a High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-c372-x57p-6x7v.