Cross-Site Scripting Vulnerabilities in Apache Geronimo Application Server

CVE-2009-0038

Summary

The Apache Geronimo Application Server contains multiple cross-site scripting (XSS) vulnerabilities within its web administration console. These vulnerabilities permit remote attackers to exploit the system by injecting arbitrary web scripts or HTML code, primarily through the manipulation of parameters such as name, IP address, username, or description in the console's monitoring interface. Furthermore, the attacker can also exploit the default URI by altering the PATH_INFO. This can lead to unauthorized actions or data exposure, making it critical for users to apply the necessary security updates to mitigate these risks.

References