TI-2008-00698 Aliases CVE-2008-0732 GHSA-442g-3x58-f2rv

The init script for Apache Geronimo on SUSE Linux follows symlinks when performing a…

LOW 13CWE-59Published 2008-02-12 · Updated 2024-09-17

Key facts

Attack vector: Local
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Partial · None · None
Fix status: No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-59 and the CVSS impact.

Summary

The init script for Apache Geronimo on SUSE Linux follows symlinks when performing a chown operation, which might allow local users to obtain access to unspecified files or directories.

Why it matters now

EPSS 0.00755 55th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:suse:suse_linux::::::::	all versions	Running on	SUSE
cpe:2.3:a:apache:geronimo::::::::	all versions	Vulnerable	Apache

cpe:2.3:o:suse:suse_linux:*:*:*:*:*:*:*:* Versions all versions Running on ·SUSE
cpe:2.3:a:apache:geronimo:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Apache

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2008-0732
2026-10-03 Alias added: GHSA-442g-3x58-f2rv

References

Patch 1

SUSE-SR:2008:003

TI-2011-04311 Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without… CVSS 2.0HIGH 7.8
TI-2008-05234 Multiple directory traversal vulnerabilities in the web administration console in Apache… CVSS 2.0HIGH 9.4
TI-2013-01564 The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM… CVSS 2.0HIGH 10.0
TI-2007-04403 The login method in LoginModule implementations in Apache Geronimo 2.0 does not throw… CVSS 2.0HIGH 10.0
TI-2006-00245 Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote… CVSS 2.0MEDIUM 4.3
TI-2009-00039 Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration… CVSS 2.0MEDIUM 6.8

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences