CVE-2007-4548: Critical severity red hat geronimo vulnerability

Published Aug 27, 2007

Updated

The login method in LoginModule implementations in Apache Geronimo 2.0 does not throw FailedLoginException for failed logins, which allows remote attackers to bypass authentication requirements, deploy arbitrary modules, and gain administrative access by sending a blank username and password with the command line deployer in the deployment module.

Affected Software

1 affected component

Apache Geronimo=2.0

Remediation

Patch Available

https://issues.apache.org/jira/browse/GERONIMO-3404

Event History

Aug 27, 2007

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2007-4548?

CVE-2007-4548 has a high severity due to its potential to allow unauthorized access and administrative control.

How do I fix CVE-2007-4548?

To fix CVE-2007-4548, upgrade to a version of Apache Geronimo that addresses this vulnerability.

What systems are affected by CVE-2007-4548?

CVE-2007-4548 affects Apache Geronimo version 2.0.

What can attackers do if they exploit CVE-2007-4548?

If exploited, attackers can bypass authentication and gain administrative access by submitting a blank username and password.

Is there a workaround for CVE-2007-4548?

Currently, there are no documented workarounds for CVE-2007-4548, and upgrading is the recommended action.