CVE-2008-5518

critical Apache
CVSS v3 Base Score
9.4
AV:N/AC:L/Au:N/C:C/I:C/A:N
EPSS Score
10.8%
Exploitation probability in 30 days
Top 7% most likely to be exploited
Attack Characteristics
Attack Vector
Network
Attack Complexity
Low
Confidentiality
C
Integrity
C
Availability
None
Published: April 17, 2009 (6236 days ago)
Last Modified: April 23, 2026
Vendor: Apache
Source: NVD

Description

Multiple directory traversal vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 on Windows allow remote attackers to upload files to arbitrary directories via directory traversal sequences in the (1) group, (2) artifact, (3) version, or (4) fileType parameter to console/portal//Services/Repository (aka the Services/Repository portlet); the (5) createDB parameter to console/portal/Embedded DB/DB Manager (aka the Embedded DB/DB Manager portlet); or the (6) filename parameter to the createKeystore script in the Security/Keystores portlet.

CWE

CWE-22

Affected Products

apache geronimo

References

🔗 dsecrg.com 🔗 geronimo.apache.org 🔗 issues.apache.org 🔗 secunia.com 🔗 www.securityfocus.com