Apache Geronimo Application Server multiple directory traversal vulnerabilities

2022-05-1402:40:10

Google

osv.dev

apache geronimo

application server

directory traversal

web administration

windows

remote attackers

upload

arbitrary directories

console

repository portlet

embedded db

db manager

security

keystores

AI Score

7.2

Confidence

Low

EPSS

0.005

Percentile

77.5%

JSON

Multiple directory traversal vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 on Windows allow remote attackers to upload files to arbitrary directories via directory traversal sequences in the (1) group, (2) artifact, (3) version, or (4) fileType parameter to console/portal//Services/Repository (aka the Services/Repository portlet); the (5) createDB parameter to console/portal/Embedded DB/DB Manager (aka the Embedded DB/DB Manager portlet); or the (6) filename parameter to the createKeystore script in the Security/Keystores portlet.