CVE-2009-0038 json
Apache Geronimo Application Server multiple cross-site scripting (XSS) vulnerabilities
published 2009-04-17 17 y ago modified 2026-06-16 4 mo ago also GHSA-c372-x57p-6x7v , EUVD-2022-3484
- cvss
- 4.3
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 18.0%
- EPSS 18.0% chance of exploitation in 30 days, percentile 97%
- public exploits
- 2
- Exploit-DB
Summary
Multiple cross-site scripting (XSS) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) ip, (3) username, or (4) description parameter to console/portal/Server/Monitoring; or (5) the PATH_INFO to the default URI under console/portal/.
Patch / fix
- maven org.apache.geronimo.plugins:console 2.1.4
Timeline
- First public exploit (EDB-32921)
- Published
Exploit prediction
18.00% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-32921 Apache Geronimo 2.1.x - '/console/portal/' URI Cross-Site Scripting remote, 2009-04-16
- EDB-32920 Apache Geronimo 2.1.x - '/console/portal/Server/Monitoring' Multiple Cross-Site Scripting Vulnerabilities remote, 2009-04-16
- securityfocus.com http://www.securityfocus.com/bid/34562 referenced PoC, tagged "exploit" by a source, unverified
- dsecrg.com http://dsecrg.com/pages/vul/show.php?id=119 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.geronimo.plugins:console | >=2.1.0, <2.1.4 |
2.1.4 |
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
geronimo.apache.org
/21x-security-report.html#2.1.xSecurityReport-214
web, patch, vendor-advisory
-
issues.apache.org
/jira/browse/GERONIMO-4597
web, patch
-
github.com
/apache/geronimo/commit/aa0c2c26dde8930cad924796af7c17a13d236b16
web
-
securityfocus.com
/bid/34562
vdb-entry, exploit
-
dsecrg.com
/pages/vul/show.php?id=119
exploit
-
vupen.com
/english/advisories/2009/1089
vdb-entry
-
securityfocus.com
/archive/1/502734/100/0/threaded
mailing-list
-
secunia.com
/advisories/34715
third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2009-0038
advisory
-
github.com
/apache/geronimo
package
-
web.archive.org
/web/20090419162753/http://secunia.com/advisories/34715
web
-
web.archive.org
/web/20090422192202/http://dsecrg.com/pages/vul/show.php?id=119
web
-
web.archive.org
/web/20200229223125/http://www.securityfocus.com/bid/34562
web
Sources
- CVE List CVE-2009-0038
- GitHub Advisory GHSA-c372-x57p-6x7v
- NVD CVE-2009-0038
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.