CVE-2008-5518

Multiple directory traversal vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 on Windows allow remote attackers to upload files to arbitrary directories via directory traversal sequences in the (1) group, (2) artifact, (3) version, or (4) fileType parameter to console/portal//Services/Repository (aka the Services/Repository portlet); the (5) createDB parameter to console/portal/Embedded DB/DB Manager (aka the Embedded DB/DB Manager portlet); or the (6) filename parameter to the createKeystore script in the Security/Keystores portlet.

• CWE-22

• http://dsecrg.com/pages/vul/show.php?id=118Exploit
• http://geronimo.apache.org/21x-security-report.html#2.1.xSecurityReport-214Patch, Vendor Advisory
• http://issues.apache.org/jira/browse/GERONIMO-4597Patch, Vendor Advisory
• http://secunia.com/advisories/34715
• http://www.securityfocus.com/archive/1/502733/100/0/threaded
• http://www.securityfocus.com/bid/34562Exploit
• http://www.vupen.com/english/advisories/2009/1089
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49898
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49899
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49900
• https://www.exploit-db.com/exploits/8458
• http://dsecrg.com/pages/vul/show.php?id=118Exploit
• http://geronimo.apache.org/21x-security-report.html#2.1.xSecurityReport-214Patch, Vendor Advisory
• http://issues.apache.org/jira/browse/GERONIMO-4597Patch, Vendor Advisory
• http://secunia.com/advisories/34715
• http://www.securityfocus.com/archive/1/502733/100/0/threaded
• http://www.securityfocus.com/bid/34562Exploit
• http://www.vupen.com/english/advisories/2009/1089
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49898
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49899
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49900
• https://www.exploit-db.com/exploits/8458

Published

Apr 17, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-5512Multiple unspecified vulnerabilities in Mozilla Firefox 3.x …
• CVE-2008-5513Unspecified vulnerability in the session-restore feature in …
• CVE-2008-5514Off-by-one error in the rfc822_output_char function in the R…
• CVE-2008-5515Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.…
• CVE-2008-5516The web interface in git (gitweb) 1.5.x before 1.5.5 allows …
• CVE-2008-5517The web interface in git (gitweb) 1.5.x before 1.5.6 allows …
• CVE-2008-5519The JK Connector (aka mod_jk) 1.2.0 through 1.2.26 in Apache…
• CVE-2008-5520AhnLab V3 2008.12.4.1 and possibly 2008.9.13.0, when Interne…
• CVE-2008-5521Avira AntiVir 7.9.0.36 and possibly 7.8.1.28, when Internet …
• CVE-2008-5522AVG Anti-Virus 8.0.0.161, when Internet Explorer 6 or 7 is u…
• CVE-2008-5523avast! antivirus 4.8.1281.0, when Internet Explorer 6 or 7 i…
• CVE-2008-5524CAT-QuickHeal 10.00 and possibly 9.50, when Internet Explore…