CVE-2007-4548
First published: Mon Aug 27 2007(Updated: )
The login method in LoginModule implementations in Apache Geronimo 2.0 does not throw FailedLoginException for failed logins, which allows remote attackers to bypass authentication requirements, deploy arbitrary modules, and gain administrative access by sending a blank username and password with the command line deployer in the deployment module.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat Geronimo | =2.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.nabble.com/Geronimo-2.0-Release-suspended-due-to-security-issue-found-before-release-t4263667s134.html
- http://geronimo.apache.org/2007/08/21/apache-geronimo-201-released.html
- https://issues.apache.org/jira/browse/GERONIMO-1201
- http://geronimo.apache.org/2007/08/13/apache-geronimo-v20-release-delayed-due-to-security-issue.html
- https://issues.apache.org/jira/browse/GERONIMO-3404
Frequently Asked Questions
What is the severity of CVE-2007-4548?
CVE-2007-4548 has a high severity due to its potential to allow unauthorized access and administrative control.
How do I fix CVE-2007-4548?
To fix CVE-2007-4548, upgrade to a version of Apache Geronimo that addresses this vulnerability.
What systems are affected by CVE-2007-4548?
CVE-2007-4548 affects Apache Geronimo version 2.0.
What can attackers do if they exploit CVE-2007-4548?
If exploited, attackers can bypass authentication and gain administrative access by submitting a blank username and password.
Is there a workaround for CVE-2007-4548?
Currently, there are no documented workarounds for CVE-2007-4548, and upgrading is the recommended action.
- agent/type
- agent/softwarecombine
- agent/references
- agent/author
- agent/weakness
- agent/severity
- agent/remedy
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/apache
- canonical/red hat geronimo
- version/red hat geronimo/2.0