Back to CVE Browser

CVE-2007-4548

CRITICAL

10.0

CVSS Severity Score

EPSS Score0.1370%

EPSS Percentile32.10th

PublishedAug 27, 2007

Last ModifiedApr 23, 2026

Vulnerability Description

The login method in LoginModule implementations in Apache Geronimo 2.0 does not throw FailedLoginException for failed logins, which allows remote attackers to bypass authentication requirements, deploy arbitrary modules, and gain administrative access by sending a blank username and password with the command line deployer in the deployment module.

Affected Platforms (CPE)

📦

Apache

Geronimo

= 2.0

References & Advisories

🔗 http://geronimo.apache.org/2007/08/13/apache-geronimo-v20-release-delayed-due-to-security-issue.html

🔗 http://geronimo.apache.org/2007/08/21/apache-geronimo-201-released.html

🔗 http://www.nabble.com/Geronimo-2.0-Release-suspended-due-to-security-issue-found-before-release-t4263667s134.html

🔗 https://issues.apache.org/jira/browse/GERONIMO-1201

🔗 https://issues.apache.org/jira/browse/GERONIMO-3404

🔗 http://geronimo.apache.org/2007/08/13/apache-geronimo-v20-release-delayed-due-to-security-issue.html

🔗 http://geronimo.apache.org/2007/08/21/apache-geronimo-201-released.html

🔗 http://www.nabble.com/Geronimo-2.0-Release-suspended-due-to-security-issue-found-before-release-t4263667s134.html

Related Vulnerabilities

CVE-2013-177710.0

The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Community Ed...

CVE-2010-20769.8

Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Ch...

CVE-2008-55189.4

Multiple directory traversal vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2...

CVE-2011-50347.8

Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisi...