Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to hijack the authentication of administrators for requests that (1) change the web administration password, (2) upload applications, and perform unspecified other administrative actions, as demonstrated by (3) a Shutdown request to console/portal//Server/Shutdown.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Apache
    Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to hijack the authentication of
    administrators for requests that (1) change the web administration password, (2) upload applications, and
    perform unspecified other administrative actions, as demonstrated by (3) a Shutdown request to
    console/portal//Server/Shutdown. (CVE-2009-0039)

This update of WebSphere fixes the following vulnerabilities :

  - GERONIMO-3838: close potential denial of service attack

  - fix Apache Geronimo web administration console directory     traversal vulnerabilities. (CVE-2008-5518)

  - fix Apache Geronimo web administration console XSS     vulnerabilities. (CVE-2009-0038)

  - fix Apache Geronimo web administration console CSRF     vulnerabilities. (CVE-2009-0039)

  - Samples: Fix Apache Tomcat cross-site scripting     vulnerability. (CVE-2009-0781)

ID	Name	Product	Family	Severity
411270	SCA: security update for org.apache.geronimo.plugins:console (GHSA-678x-xfp4-r92r)	Tenable Cloud Security	SCA Checks	high
411270	SCA: security update for org.apache.geronimo.plugins:console (GHSA-678x-xfp4-r92r)	Tenable Self-Hosted Container Security	SCA Checks	high
52690	SuSE 11 Security Update : Websphere Community Edition (SAT Patch Number 1016)	Nessus	SuSE Local Security Checks	high
41597	SuSE 10 Security Update : Websphere Community Edition (ZYPP Patch Number 6312)	Nessus	SuSE Local Security Checks	high
41458	SuSE 11 Security Update : Websphere Community Edition (SAT Patch Number 1016)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2009-0039

high

Tenable Plugins

high

high

high

high

high