Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer.
| Type | CWE ID | Description |
|---|---|---|
| text | N/A | n/a |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://rhn.redhat.com/errata/RHSA-2008-0630.html | vendor-advisory x_refsource_REDHAT |
| http://secunia.com/advisories/31493 | third-party-advisory x_refsource_SECUNIA |
| http://www.oliverkarow.de/research/geronimo_css.txt | x_refsource_MISC |
| https://issues.apache.org/jira/secure/ReleaseNote.jspa?version=12310181&styleName=Html&projectId=10220&Create=Create | x_refsource_CONFIRM |
| http://www.securityfocus.com/bid/16260 | vdb-entry x_refsource_BID |
| http://www.vupen.com/english/advisories/2006/0217 | vdb-entry x_refsource_VUPEN |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/24159 | vdb-entry x_refsource_XF |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/24158 | vdb-entry x_refsource_XF |
| http://www.securityfocus.com/archive/1/421996/100/0/threaded | mailing-list x_refsource_BUGTRAQ |
| http://www.redhat.com/support/errata/RHSA-2008-0261.html | vendor-advisory x_refsource_REDHAT |
| http://issues.apache.org/jira/browse/GERONIMO-1474 | x_refsource_MISC |
| http://secunia.com/advisories/18485 | third-party-advisory x_refsource_SECUNIA |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|