CVE-2009-0039: Apache Geronimo Application Server CSRF vulnerabilities
Summary
CVE-2009-0039: Apache Geronimo Application Server CSRF vulnerabilities. Affects org.apache.geronimo.plugins:console versions < 2.1.4. Fixed in 2.1.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Geronimo Application Server is an open-source Java EE application server that provides a platform for deploying and running enterprise applications. It offers features such as web services, security, and clustering. The web administration console is a component of Apache Geronimo Application Server that allows administrators to manage and configure the server remotely.
Vulnerability Detail
Multiple cross-site request forgery (CSRF) vulnerabilities have been discovered in the web administration console of Apache Geronimo Application Server versions 2.1 through 2.1.3. These vulnerabilities allow remote attackers to hijack the authentication of administrators and perform unauthorized actions. Specifically, attackers can change the web administration password, upload applications, and execute other administrative actions. An example of such an action is sending a Shutdown request to the server, leading to a denial of service.
How To Fix
Latest published version: 3.0.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for these CSRF vulnerabilities. It is crucial to apply the recommended fix by upgrading to Apache Geronimo Application Server version 2.1.4 or later.
Conclusion
Multiple CSRF vulnerabilities have been identified in Apache Geronimo Application Server versions 2.1 through 2.1.3. These vulnerabilities allow attackers to hijack administrator authentication and perform unauthorized actions. To mitigate these risks, it is essential to upgrade to Apache Geronimo Application Server version 2.1.4 or later. This upgrade includes patches and security enhancements that address the CSRF vulnerabilities. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.geronimo.plugins:console →
FAQ
Apache Geronimo Application Server is an open-source Java EE application server that provides a platform for deploying and running enterprise applications.
Cross-Site Request Forgery (CSRF) is an attack that tricks the victim into submitting a malicious request. In the case of Apache Geronimo Application Server, CSRF vulnerabilities allow attackers to perform unauthorized actions on behalf of administrators.
An attacker can change the web administration password, upload applications, and execute other administrative actions. For example, they can send a Shutdown request to the server, causing a denial of service.
To fix these vulnerabilities, you should upgrade to Apache Geronimo Application Server version 2.1.4 or later. This version includes patches and security enhancements that address the CSRF vulnerabilities.
No, there is no known workaround for these CSRF vulnerabilities. It is crucial to apply the recommended fix by upgrading to Apache Geronimo Application Server version 2.1.4 or later.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.geronimo.plugins:console.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
