CVEvulnerability
CVE-2007-4548
10.0 HIGH
Official page ↗
- Status
- Modified
- Published
- 2007-08-27
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-287
Description
The login method in LoginModule implementations in Apache Geronimo 2.0 does not throw FailedLoginException for failed logins, which allows remote attackers to bypass authentication requirements, deploy arbitrary modules, and gain administrative access by sending a blank username and password with the command line deployer in the deployment module.
Affected configurations
• apache geronimo 2.0
Related
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- http://geronimo.apache.org/2007/08/13/apache-geronimo-v20-release-delayed-due-to-security-issue.html geronimo.apache.org
- http://geronimo.apache.org/2007/08/21/apache-geronimo-201-released.html geronimo.apache.org
- http://www.nabble.com/Geronimo-2.0-Release-suspended-due-to-security-issue-found-before-release-t4263667s134.html www.nabble.com
- https://issues.apache.org/jira/browse/GERONIMO-1201 issues.apache.org
- https://issues.apache.org/jira/browse/GERONIMO-3404 Patch
- http://geronimo.apache.org/2007/08/13/apache-geronimo-v20-release-delayed-due-to-security-issue.html geronimo.apache.org
- http://geronimo.apache.org/2007/08/21/apache-geronimo-201-released.html geronimo.apache.org
- http://www.nabble.com/Geronimo-2.0-Release-suspended-due-to-security-issue-found-before-release-t4263667s134.html www.nabble.com
- https://issues.apache.org/jira/browse/GERONIMO-1201 issues.apache.org
- https://issues.apache.org/jira/browse/GERONIMO-3404 Patch