CVE-2006-0254
Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 32.2%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 32.25% probability · 98th percentile
- CISA KEV
- Not listed
- Affected
- apache/geronimo
- Source
- cve@mitre.org
References
- http://issues.apache.org/jira/browse/GERONIMO-1474Exploit, Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2008-0630.html
- http://secunia.com/advisories/18485Vendor Advisory
- http://secunia.com/advisories/31493
- http://www.oliverkarow.de/research/geronimo_css.txtExploit, Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2008-0261.html
- http://www.securityfocus.com/archive/1/421996/100/0/threaded
- http://www.securityfocus.com/bid/16260Exploit
- http://www.vupen.com/english/advisories/2006/0217
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24158
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24159
- https://issues.apache.org/jira/secure/ReleaseNote.jspa?version=12310181&styleName=Html&projectId=10220&Create=Create
- http://issues.apache.org/jira/browse/GERONIMO-1474Exploit, Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2008-0630.html
- http://secunia.com/advisories/18485Vendor Advisory
- http://secunia.com/advisories/31493
- http://www.oliverkarow.de/research/geronimo_css.txtExploit, Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2008-0261.html
- http://www.securityfocus.com/archive/1/421996/100/0/threaded
- http://www.securityfocus.com/bid/16260Exploit
- http://www.vupen.com/english/advisories/2006/0217
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24158
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24159
- https://issues.apache.org/jira/secure/ReleaseNote.jspa?version=12310181&styleName=Html&projectId=10220&Create=Create
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.