Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to hijack the authentication of administrators for requests that (1) change the web administration password, (2) upload applications, and perform unspecified other administrative actions, as demonstrated by (3) a Shutdown request to console/portal//Server/Shutdown.

This update of WebSphere fixes the following vulnerabilities :

  - GERONIMO-3838: close potential denial of service attack

  - fix Apache Geronimo web administration console directory     traversal vulnerabilities. (CVE-2008-5518)

  - fix Apache Geronimo web administration console XSS     vulnerabilities. (CVE-2009-0038)

  - fix Apache Geronimo web administration console CSRF     vulnerabilities. (CVE-2009-0039)

  - Samples: Fix Apache Tomcat cross-site scripting     vulnerability. (CVE-2009-0781)

ID	Name	Product	Family	Severity
52690	SuSE 11 Security Update : Websphere Community Edition (SAT Patch Number 1016)	Nessus	SuSE Local Security Checks	high
41597	SuSE 10 Security Update : Websphere Community Edition (ZYPP Patch Number 6312)	Nessus	SuSE Local Security Checks	high
41458	SuSE 11 Security Update : Websphere Community Edition (SAT Patch Number 1016)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2009-0039

high

Tenable Plugins

high

high

high