CVE-2006-0254: apache geronimo
Vulnerability summary
CVE-2006-0254 is a medium (CVSS 4.3) vulnerability in apache geronimo. EPSS estimates a 32.25% chance of exploitation in the next 30 days, higher than 98.3% of scored vulnerabilities. 5 public exploits are recorded.
Weaponized exploit (exploit-database, 16-01-2006)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 3Timeline
- 18-01-2006PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
32.25%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
No change 0.00 pp
From 32.25% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
5 foundExploit Reference (oliverkarow.de)
Maturity: unknown
Exploit Reference (securityfocus.com)
Maturity: unknown
Exploit Reference (issues.apache.org)
Maturity: unknown
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Apache1 product
- geronimo1.0
Geronimo1 product
- geronimo-console-standard< 1.1
2 vendors · 2 products
