medium6.8Public exploit code
CVE-2009-0039
Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remo…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Apache Geronimo 2.1.x - Cross-Site Request Forgery (Multiple Admin Function)2009-04-16 · remote · multiple · Verified
Impact
Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to hijack the authentication of administrators for requests that (1) change the web administration password, (2) upload applications, and perform unspecified other administrative actions, as demonstrated by (3) a Shutdown request to console/portal//Server/Shutdown.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Geronimo | Versions 2.1, 2.1.1, 2.1.2, 2.1.3 |
Weakness classification
References
- NVD record
- CVE.org record
- http://dsecrg.com/pages/vul/show.php?id=120
- http://geronimo.apache.org/21x-security-report.html#2.1.xSecurityReport-214
- http://issues.apache.org/jira/browse/GERONIMO-4597
- http://secunia.com/advisories/34715
- http://www.securityfocus.com/archive/1/502735/100/0/threaded
- http://www.securityfocus.com/bid/34562
- http://www.vupen.com/english/advisories/2009/1089
- http://dsecrg.com/pages/vul/show.php?id=120
- http://geronimo.apache.org/21x-security-report.html#2.1.xSecurityReport-214
- http://issues.apache.org/jira/browse/GERONIMO-4597
- http://secunia.com/advisories/34715
- http://www.securityfocus.com/archive/1/502735/100/0/threaded
- http://www.securityfocus.com/bid/34562
- http://www.vupen.com/english/advisories/2009/1089