$ cve CVE-2008-5518 JSON

CVE-2008-5518 EXPLOIT

9.4

HIGH · CVSS 2.0 · EPSS 35.9% (pctl 98)

Patch early

A public exploit exists.

Description

Multiple directory traversal vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 on Windows allow remote attackers to upload files to arbitrary directories via directory traversal sequences in the (1) group, (2) artifact, (3) version, or (4) fileType parameter to console/portal//Services/Repository (aka the Services/Repository portlet); the (5) createDB parameter to console/portal/Embedded DB/DB Manager (aka the Embedded DB/DB Manager portlet); or the (6) filename parameter to the createKeystore script in the Security/Keystores portlet.

Scoring

CVSS	9.4 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:C/I:C/A:N
EPSS	35.93% — more likely to be exploited than 98% of all CVEs
Weakness	CWE-22
On CISA KEV	no
Public exploit	yes
Published	2009-04-17
Last modified	2026-06-16

Affected (2)

Vendor	Product
apache	geronimo
microsoft	windows

Public exploits

Source	Title	Date
exploit-db	Apache Geronimo 2.1.3 - Multiple Directory Traversal Vulnerabilities	2009-04-16

References

→ the Explorer · watch your stack · NVD