Apache Geronimo Application Server Multiple Directory Traversal Vulnerabilities in org.apache.geronimo.plugins:console
Summary
CVE-2008-5518: Apache Geronimo Application Server multiple directory traversal vulnerabilities. Affects org.apache.geronimo.plugins:console versions >= 2.1.0, < 2.1.4. Fixed in 2.1.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Geronimo Application Server is an open-source Java EE application server that provides a platform for deploying and running Java applications. The org.apache.geronimo.plugins:console package is a component of the server that includes web administration console functionality. This vulnerability affects versions 2.1 through 2.1.3 of the Apache Geronimo Application Server on Windows.
Vulnerability Detail
Multiple directory traversal vulnerabilities have been identified in the web administration console of Apache Geronimo Application Server. These vulnerabilities allow remote attackers to upload files to arbitrary directories by exploiting directory traversal sequences in various parameters of different portlets. The affected portlets include Services/Repository, Embedded DB/DB Manager, and Security/Keystores. By manipulating these parameters, an attacker can bypass file upload restrictions and potentially upload malicious files to sensitive directories.
How To Fix
Latest published version: 3.0.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to a patched version of Apache Geronimo Application Server.
Conclusion
Multiple directory traversal vulnerabilities have been identified in Apache Geronimo Application Server, specifically in the org.apache.geronimo.plugins:console package. These vulnerabilities allow remote attackers to upload files to arbitrary directories, posing a risk of unauthorized access and potential compromise of sensitive data. It is strongly advised to upgrade to version 2.1.4 or later to mitigate the risk of exploitation. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.geronimo.plugins:console →
FAQ
Apache Geronimo Application Server is an open-source Java EE application server that provides a platform for deploying and running Java applications.
The org.apache.geronimo.plugins:console package is a component of Apache Geronimo Application Server that includes web administration console functionality.
Directory traversal vulnerabilities allow attackers to access files and directories outside of the intended scope by manipulating input parameters that specify file paths.
These vulnerabilities can allow remote attackers to upload files to arbitrary directories, potentially leading to unauthorized access, data leakage, or remote code execution.
No, there is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to a patched version of Apache Geronimo Application Server.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.geronimo.plugins:console.
