CVE-2008-5518 Apache Geronimo Application Server multiple directory traversal vulnerabilities
HighCVSS 9.4
EPSS 35.9%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple directory traversal vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 on Windows allow remote attackers to upload files to arbitrary directories via directory traversal sequences in the (1) group, (2) artifact, (3) version, or (4) fileType parameter to console/portal//Services/Repository (aka the Services/Repository portlet); the (5) createDB parameter to console/portal/Embedded DB/DB Manager (aka the Embedded DB/DB Manager portlet); or the (6) filename parameter to the createKeystore script in the Security/Keystores portlet.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.geronimo.plugins/console(Maven) | >= 2.1.0, < 2.1.4 | 2.1.4 |
| org.apache.geronimo.plugins/console(Maven) | = 2.1 | No fix listed |
| org.apache.geronimo.plugins/console(Maven) | = 2.1.1 | No fix listed |
| org.apache.geronimo.plugins/console(Maven) | = 2.1.2 | No fix listed |
| org.apache.geronimo.plugins/console(Maven) | = 2.1.3 | No fix listed |
| apache geronimo | = 2.1 | No fix listed |
| apache geronimo | = 2.1.1 | No fix listed |
| apache geronimo | = 2.1.2 | No fix listed |
| apache geronimo | = 2.1.3 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- geronimo-repository-directory-traversal(49898) vdb-entry
- geronimo-dbmanager-directory-traversal(49899) vdb-entry
- geronimo-keystores-directory-traversal(49900) vdb-entry
- github.com product
- web.archive.org
- web.archive.org
- web.archive.org
- 8458 exploit
- geronimo.apache.org patch vendor-advisory
- issues.apache.org patch vendor-advisory
- github.com
- dsecrg.com exploit
- 34715 third-party-advisory
- 20090416 [DSECRG-09-018] Apache Geronimo - Directory Traversal vulnerabilities mailing-list
- 34562 exploit vdb-entry
- ADV-2009-1089 vdb-entry