NVD

Id
56668  
Name
CVE-2007-4548  
Description
The login method in LoginModule implementations in Apache Geronimo 2.0 does not throw FailedLoginException for failed logins, which allows remote attackers to bypass authentication requirements, deploy arbitrary modules, and gain administrative access by sending a blank username and password with the command line deployer in the deployment module.  
Reject
 
CVSS Version
2  
CVSS Score
10  
Severity
High  
CVSS Base Score
10  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-07  
Published
2007-08-27  
Modified Date
2008-09-05  
Seq
2007-4548  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
288776 56668 CVE-2007-4548 http://geronimo.apache.org/2007/08/13/apache-geronimo-v20-release-delayed-due-to-security-issue.html  View
288777 56668 CVE-2007-4548 http://geronimo.apache.org/2007/08/21/apache-geronimo-201-released.html  View
288778 56668 CVE-2007-4548 [dev] 20070813 Geronimo 2.0 Release suspended due to security issue found before release  View
288779 56668 CVE-2007-4548 https://issues.apache.org/jira/browse/GERONIMO-1201  View
288780 56668 CVE-2007-4548 https://issues.apache.org/jira/browse/GERONIMO-3404  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
52514 JVNDB-2007-001206 Apache Geronimo の LoginModule 実装における認証要求を回避される脆弱性 Apache Geronimo の LoginModule 実装のログインメソッドには、ログインに失敗した際、FailedLoginException のエラー処理を適切に行わないため、認証要求を回避し、任意のモジュールを展開され、コマンドラインのデプロイヤを利用して空のユーザ名およびパスワードを送信することにより管理アクセス権を取得される脆弱性が存在します。 CVE-2007-4548 27903 CVE-2007-4548 56668 10 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-001206.html 2007-08-13 2010-07-22 View