2009-0039 | Apache Geronimo Administration Console cross-site request forgery (BID-34562 / XFDB-49925)
| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 6.0 | $0-$5k | 0.88 |
A vulnerability, which was classified as critical, has been found in Apache Geronimo 2.1/2.1.1/2.1.2/2.1.3. This issue affects an unknown code block of the component Administration Console. The manipulation with an unknown input leads to a cross site request forgery vulnerability. Using CWE to declare the problem leads to CWE-352. Impacted is confidentiality, integrity, and availability. An attacker might be able force legitimate users to initiate unwanted actions within the web application.
The weakness was released 04/17/2009 by DiGiT with Digital Security Research Group (Website). The advisory is shared at vupen.com. The identification of this vulnerability is CVE-2009-0039 since 12/15/2008. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are unknown but a public exploit is available.
It is declared as proof-of-concept. The exploit is available at securityfocus.com. The vulnerability scanner Nessus provides a plugin with the ID 52690 (SuSE 11 Security Update : Websphere Community Edition (SAT Patch Number 1016)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family SuSE Local Security Checks.
There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.
The vulnerability is also documented in the databases at SecurityFocus (BID 34562), X-Force (49925), Secunia (SA34715), Vulnerability Center (SBV-25878) and Tenable (52690). Entries connected to this vulnerability are available at 47800 and 47799.
Vendor
Name
VulDB Meta Base Score: 6.3
VulDB Meta Temp Score: 6.0
VulDB Base Score: 6.3
VulDB Temp Score: 6.0
VulDB Vector: 🔍
VulDB Reliability: 🔍
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 🔍 | 🔍 | 🔍 | 🔍 | 🔍 | 🔍 |
| 🔍 | 🔍 | 🔍 | 🔍 | 🔍 | 🔍 |
| 🔍 | 🔍 | 🔍 | 🔍 | 🔍 | 🔍 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| unlock | unlock | unlock | unlock | unlock | unlock |
| unlock | unlock | unlock | unlock | unlock | unlock |
| unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Class: Cross site request forgery
CWE: CWE-352
ATT&CK: Unknown
Local: No
Remote: Yes
Availability: 🔍
Access: Public
Status: Proof-of-Concept
Download: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
| 0-Day | unlock | unlock | unlock | unlock |
|---|---|---|---|---|
| Today | unlock | unlock | unlock | unlock |
Nessus ID: 52690
Nessus Name: SuSE 11 Security Update : Websphere Community Edition (SAT Patch Number 1016)
Nessus File: 🔍
Nessus Risk: 🔍
Nessus Family: 🔍
OpenVAS ID: 65766
OpenVAS Name: SLES10: Security update for Websphere Community Edition
OpenVAS File: 🔍
OpenVAS Family: 🔍
Threat Intelligence
Interest: 🔍
Active Actors: 🔍
Active APT Groups: 🔍Recommended: no mitigation known
Status: 🔍
0-Day Time: 🔍
12/15/2008 🔍
04/16/2009 🔍
04/17/2009 🔍
04/17/2009 🔍
04/17/2009 🔍
04/17/2009 🔍
05/27/2010 🔍
03/17/2015 🔍
08/09/2021 🔍Vendor: https://www.apache.org/
Advisory: vupen.com
Researcher: DiGiT
Organization: Digital Security Research Group
Status: Not defined
Confirmation: 🔍
CVE: CVE-2009-0039 (🔍)
SecurityFocus: 34562 – Apache Geronimo Application Server Multiple Remote Vulnerabilities
Secunia: 34715 – Apache Geronimo Multiple Vulnerabilities, Less Critical
X-Force: 49925
Vulnerability Center: 25878 – Apache Geronimo Application Server 2.1 – 2.1.3 Multiple CSRF Vulnerabilities, Medium
Vupen: ADV-2009-1089
scip Labs: https://www.scip.ch/en/?labs.20161013
See also: 🔍
Created: 03/17/2015 23:38
Updated: 08/09/2021 16:05
Changes: (3) source_nessus_risk exploit_price_0day vulnerability_cvss2_nvd_basescore
Complete: 🔍
Enable the mail alert feature now!
