CVE-2009-0039
published 2009-04-17CVE-2009-0039: Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow…
PriorityP341medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EXPLOIT
EPSS
11.06%
95.4th percentile
Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to hijack the authentication of administrators for requests that (1) change the web administration password, (2) upload applications, and perform unspecified other administrative actions, as demonstrated by (3) a Shutdown request to console/portal//Server/Shutdown.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | geronimo | — | — |
| apache | geronimo | — | — |
| apache | geronimo | — | — |
| apache | geronimo | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Apache Geronimo Application Server CSRF vulnerabilities
osv·2022-05-02
CVE-2009-0039 [MEDIUM] Apache Geronimo Application Server CSRF vulnerabilities
Apache Geronimo Application Server CSRF vulnerabilities
Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to hijack the authentication of administrators for requests that (1) change the web administration password, (2) upload applications, and perform unspecified other administrative actions, as demonstrated by (3) a Shutdown request to console/portal//Server/Shutdown.
GHSA
Apache Geronimo Application Server CSRF vulnerabilities
ghsa·2022-05-02
CVE-2009-0039 [MEDIUM] CWE-352 Apache Geronimo Application Server CSRF vulnerabilities
Apache Geronimo Application Server CSRF vulnerabilities
Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to hijack the authentication of administrators for requests that (1) change the web administration password, (2) upload applications, and perform unspecified other administrative actions, as demonstrated by (3) a Shutdown request to console/portal//Server/Shutdown.
No detection rules found.
No writeups or analysis indexed.
http://dsecrg.com/pages/vul/show.php?id=120http://geronimo.apache.org/21x-security-report.html#2.1.xSecurityReport-214http://issues.apache.org/jira/browse/GERONIMO-4597http://secunia.com/advisories/34715http://www.securityfocus.com/archive/1/502735/100/0/threadedhttp://www.securityfocus.com/bid/34562http://www.vupen.com/english/advisories/2009/1089http://dsecrg.com/pages/vul/show.php?id=120http://geronimo.apache.org/21x-security-report.html#2.1.xSecurityReport-214http://issues.apache.org/jira/browse/GERONIMO-4597http://secunia.com/advisories/34715http://www.securityfocus.com/archive/1/502735/100/0/threadedhttp://www.securityfocus.com/bid/34562http://www.vupen.com/english/advisories/2009/1089
2009-04-17
Published