CVE-2009-0038
Apache Geronimo Application Server multiple cross-site scripting (XSS) vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) ip, (3) username, or (4) description parameter to console/portal/Server/Monitoring; or (5) the PATH_INFO to the default URI under console/portal/.
Exploit likelihood
What each source reports
NVD Score used
Multiple cross-site scripting (XSS) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) ip, (3) username, or (4) description parameter to console/portal/Server/Monitoring; or (5) the PATH_INFO to the default URI under console/portal/.
- Record
CVE-2009-0038- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Multiple cross-site scripting (XSS) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) ip, (3) username, or (4) description parameter to console/portal/Server/Monitoring; or (5) the PATH_INFO to the default URI under console/portal/.
- Record
CVE-2009-0038- Updated
- 2026-11-02
EUVDEUVD-2022-3484 No score
Multiple cross-site scripting (XSS) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) ip, (3) username, or (4) description parameter to console/portal/Server/Monitoring; or (5) the PATH_INFO to the default URI under console/portal/.
- Record
EUVD-2022-3484- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c372-x57p-6x7v No score
Apache Geronimo Application Server multiple cross-site scripting (XSS) vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) ip, (3) username, or (4) description parameter to console/portal/Server/Monitoring; or (5) the PATH_INFO to the default URI under console/portal/.
- Record
GHSA-c372-x57p-6x7v- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-c372-x57p-6x7v No score
Apache Geronimo Application Server multiple cross-site scripting (XSS) vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) ip, (3) username, or (4) description parameter to console/portal/Server/Monitoring; or (5) the PATH_INFO to the default URI under console/portal/.
- Record
GHSA-c372-x57p-6x7v- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.geronimo.plugins:consoleMaven |
2.1.0 up to 2.1.4 | 2.1.4 |
org.apache.geronimo.plugins:consoleMaven |
2.1.0 up to 2.1.4, plus listed versions 2.12.1.12.1.22.1.3 |
2.1.4 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Apache Geronimo 2.1.x - '/console/portal/Server/Monitoring' Multiple Cross-Site Scripting Vulnerabilities | 2009-04-16 |
| Exploit-DB | Apache Geronimo 2.1.x - '/console/portal/' URI Cross-Site Scripting | 2009-04-16 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-0038 is a medium vulnerability (CVSS 4.3) in Apache Geronimo, published April 17, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 18.0%, the 97th percentile. Fixed in org.apache.geronimo.plugins:console 2.1.4.
References
geronimo.apache.org/21x-security-report.html
vupen.com/english/advisories/2009/1089
securityfocus.com/bid/34562
issues.apache.org/jira/browse/GERONIMO-4597
secunia.com/advisories/34715
Show 8 moreShow less
dsecrg.com/pages/vul/show.php?id=119
nvd.nist.gov/vuln/detail/CVE-2009-0038
github.com/apache/geronimo/commit/aa0c2c26dde8930cad924796af7c17a13d236b16
web.archive.org/web/20090419162753/http://secunia.com/advisories/34715