10

CVE-2007-4548

EPSS 0.75%
Veröffentlicht 27.08.2007 23:17:00
Zuletzt bearbeitet 09.04.2025 00:30:58
Quelle cve@mitre.org
Teams Watchlist Login
Unerledigt Login

The login method in LoginModule implementations in Apache Geronimo 2.0 does not throw FailedLoginException for failed logins, which allows remote attackers to bypass authentication requirements, deploy arbitrary modules, and gain administrative access by sending a blank username and password with the command line deployer in the deployment module.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 8

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Apache ≫ Geronimo Version2.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.75%	0.707

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	10	10	10	AV:N/AC:L/Au:N/C:C/I:C/A:C

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

http://geronimo.apache.org/2007/08/13/apache-geronimo-v20-release-delayed-due-to-security-issue.html

http://geronimo.apache.org/2007/08/21/apache-geronimo-201-released.html

http://www.nabble.com/Geronimo-2.0-Release-suspended-due-to-security-issue-found-before-release-t4263667s134.html

https://issues.apache.org/jira/browse/GERONIMO-1201

https://issues.apache.org/jira/browse/GERONIMO-3404

Patch

https://nvd.nist.gov/vuln/detail/CVE-2007-4548

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2007-4548

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2007-4548

EUVD