VYPR
← All advisories
High severityNVD Advisory· Published Apr 17, 2009· Updated Jun 16, 2026

CVE-2008-5518

CVE-2008-5518

Description

Multiple directory traversal vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 on Windows allow remote attackers to upload files to arbitrary directories via directory traversal sequences in the (1) group, (2) artifact, (3) version, or (4) fileType parameter to console/portal//Services/Repository (aka the Services/Repository portlet); the (5) createDB parameter to console/portal/Embedded DB/DB Manager (aka the Embedded DB/DB Manager portlet); or the (6) filename parameter to the createKeystore script in the Security/Keystores portlet.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.geronimo.plugins:consoleMaven
>= 2.1.0, < 2.1.42.1.4

Affected products

5
  • Apache/Geronimo4 versions
    cpe:2.3:a:apache:geronimo:2.1:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:apache:geronimo:2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:geronimo:2.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:geronimo:2.1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:geronimo:2.1.3:*:*:*:*:*:*:*
  • ghsa-coords
    pkg:maven/org.apache.geronimo.plugins/console
    Range: >= 2.1.0, < 2.1.4

Patches

Vulnerability mechanics

References

17

News mentions

0

No linked articles in our index yet.