CVE-2009-0038: apache geronimo Cross-site Scripting

EPSS trend

Probability

18.00%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

0.00 pp

From 18.00% on 20-09-2026

20-09-202620-10-2026

EPSS score

18.00%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

4 found

referenceUnverified
Exploit Reference (securityfocus.com)
Maturity: unknown
referenceUnverified
Exploit Reference (dsecrg.com)
Maturity: unknown
exploit-databaseremotemultipleVerified
Apache Geronimo 2.1.x - '/console/portal/' URI Cross-Site Scripting
Maturity: weaponized

Show all 4 exploits

exploit-databaseremotemultipleVerified
Apache Geronimo 2.1.x - '/console/portal/Server/Monitoring' Multiple Cross-Site Scripting Vulnerabilities
Maturity: weaponized

References

13 links

geronimo.apache.org/21x-security-report.htmlX Refsource CONFIRMPatchVendor AdvisoryWEB
www.vupen.com/english/advisories/2009/1089VDB EntryX Refsource VUPEN
www.securityfocus.com/bid/34562VDB EntryX Refsource BIDExploit
www.securityfocus.com/archive/1/502734/100/0/threadedMailing ListX Refsource BUGTRAQ
issues.apache.org/jira/browse/GERONIMO-4597X Refsource CONFIRMPatchWEB
secunia.com/advisories/34715Third Party AdvisoryX Refsource SECUNIA
dsecrg.com/pages/vul/show.php?id=119X Refsource MISCExploit
nvd.nist.gov/vuln/detail/CVE-2009-0038Advisory
github.com/apache/geronimo/commit/aa0c2c26dde8930cad924796af7c17a13d236b16WEB
github.com/apache/geronimoPACKAGE

Show all 13 references

Related vulnerabilities

CVE-2013-1777apachegeronimo+29.81%13y ago11-07-2013 22:00The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Community Edition 3.0.0.3 and other products, does not properly implement the RMI classloader, which allows remote attackers to execute arbitrary code by using the JMX connector to send a crafted serialized object.CVE-2007-4548apachegeronimo4.19%19y ago27-08-2007 23:00The login method in LoginModule implementations in Apache Geronimo 2.0 does not throw FailedLoginException for failed logins, which allows remote attackers to bypass authentication requirements, deploy arbitrary modules, and gain administrative access by sending a blank username and password with the command line deployer in the deployment module.CVE-2007-5085apachegeronimo3.20%19y ago26-09-2007 10:00Unspecified vulnerability in the management EJB (MEJB) in Apache Geronimo before 2.0.2 allows remote attackers to bypass authentication and obtain "access to Geronimo internals" via unspecified vectors.CVE-2007-5797apachegeronimo3.15%18y ago03-11-2007 00:00SQLLoginModule in Apache Geronimo 2.0 through 2.1 does not throw an exception for a nonexistent username, which allows remote attackers to bypass authentication via a login attempt with any username not contained in the database.CVE-2008-5518apachegeronimo+135.93%17y ago17-04-2009 14:00Multiple directory traversal vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 on Windows allow remote attackers to upload files to arbitrary directories via directory traversal sequences in the (1) group, (2) artifact, (3) version, or (4) fileType parameter to console/portal//Services/Repository (aka the Services/Repository portlet); the (5) createDB parameter to console/portal/Embedded DB/DB Manager (aka the Embedded DB/DB Manager portlet); or the (6) filename parameter to the createKeystore script in the Security/Keystores portlet.CVE-2011-5034apachegeronimo+180.57%14y ago30-12-2011 01:00Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.

All vulnerabilities ingeronimo

CVE-2009-0038: apache geronimo Cross-site Scripting

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References