CVE-2009-0038
NoneCVSS
—
EPSS
18.0%
Published
Apr 17, 2009
CISA due date
—
The record
Multiple cross-site scripting (XSS) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) ip, (3) username, or (4) description parameter to console/portal/Server/Monitoring; or (5) the PATH_INFO to the default URI under console/portal/.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.geronimo.plugins:console | 2.1.0 | 2.1.4 |
Related vulnerabilities
- CVE-2009-0039 Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration… Also affects org.apache.geronimo.plugins:console
- CVE-2008-5518 Multiple directory traversal vulnerabilities in the web administration console in Apache… Also affects org.apache.geronimo.plugins:console
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96368 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96361 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96362 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96360 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79