Multiple cross-site scripting (XSS) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) ip, (3) username, or (4) description parameter to console/portal/Server/Monitoring; or (5) the PATH_INFO to the default URI under console/portal/.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Multiple cross-site scripting (XSS) vulnerabilities in the web administration console in Apache Geronimo
    Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the
    (1) name, (2) ip, (3) username, or (4) description parameter to console/portal/Server/Monitoring; or (5)
    the PATH_INFO to the default URI under console/portal/. (CVE-2009-0038)

This update of WebSphere fixes the following vulnerabilities :

  - GERONIMO-3838: close potential denial of service attack

  - fix Apache Geronimo web administration console directory     traversal vulnerabilities. (CVE-2008-5518)

  - fix Apache Geronimo web administration console XSS     vulnerabilities. (CVE-2009-0038)

  - fix Apache Geronimo web administration console CSRF     vulnerabilities. (CVE-2009-0039)

  - Samples: Fix Apache Tomcat cross-site scripting     vulnerability. (CVE-2009-0781)

ID	Name	Product	Family	Severity
432349	SCA: security update for org.apache.geronimo.plugins:console (GHSA-c372-x57p-6x7v)	Tenable Cloud Security	SCA Checks	medium
432349	SCA: security update for org.apache.geronimo.plugins:console (GHSA-c372-x57p-6x7v)	Tenable Self-Hosted Container Security	SCA Checks	medium
52690	SuSE 11 Security Update : Websphere Community Edition (SAT Patch Number 1016)	Nessus	SuSE Local Security Checks	high
41597	SuSE 10 Security Update : Websphere Community Edition (ZYPP Patch Number 6312)	Nessus	SuSE Local Security Checks	high
41458	SuSE 11 Security Update : Websphere Community Edition (SAT Patch Number 1016)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2009-0038

medium

Tenable Plugins

medium

medium

high

high

high