CVE-2006-0254
CVE-2006-0254 is a medium-severity vulnerability in Apache Geronimo with a CVSS 2.0 base score of 4.3. Its EPSS exploit-prediction score of 32% places it in the 98th percentile, indicating an elevated likelihood of exploitation.
Key facts
- Severity: Medium (CVSS 2.0 base score 4.3)
- EPSS exploit prediction: 32% (98th percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Apache Geronimo
- Published:
- Last modified:
Description
Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer.
Frequently asked questions
- What is CVE-2006-0254?
- Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer.
- How severe is CVE-2006-0254?
- CVE-2006-0254 has a CVSS 2.0 base score of 4.3, rated medium severity.
- Is CVE-2006-0254 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 32% (98th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2006-0254?
- CVE-2006-0254 affects Apache Geronimo. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2006-0254?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2006-0254 published?
- CVE-2006-0254 was published on 2006-01-18 and last updated on 2026-06-16.
References
- http://issues.apache.org/jira/browse/GERONIMO-1474
- http://rhn.redhat.com/errata/RHSA-2008-0630.html
- http://secunia.com/advisories/18485
- http://secunia.com/advisories/31493
- http://www.oliverkarow.de/research/geronimo_css.txt
- http://www.redhat.com/support/errata/RHSA-2008-0261.html
- http://www.securityfocus.com/archive/1/421996/100/0/threaded
- http://www.securityfocus.com/bid/16260
- http://www.vupen.com/english/advisories/2006/0217
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24158
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24159
- https://issues.apache.org/jira/secure/ReleaseNote.jspa?version=12310181&styleName=Html&projectId=10220&Create=Create
Affected products (1)
- cpe:2.3:a:apache:geronimo:1.0:*:*:*:*:*:*:*
More vulnerabilities in Apache Geronimo
- CVE-2013-1777 — Critical (CVSS 10.0): The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS)…
- CVE-2007-4548 — Critical (CVSS 10.0): The login method in LoginModule implementations in Apache Geronimo 2.0 does not throw FailedLoginException for failed…
- CVE-2008-5518 — Critical (CVSS 9.4): Multiple directory traversal vulnerabilities in the web administration console in Apache Geronimo Application Server…
- CVE-2011-5034 — High (CVSS 7.8): Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger…
- CVE-2007-5797 — High (CVSS 7.5): SQLLoginModule in Apache Geronimo 2.0 through 2.1 does not throw an exception for a nonexistent username, which allows…
- CVE-2009-0039 — Medium (CVSS 6.8): Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Apache Geronimo…