CVEブラウザに戻る

CVE-2007-4548

CRITICAL

10.0

CVSS Severity Score

EPSS Score0.1370%

EPSS Percentile32.10th

Published2007年8月27日

Last Modified2026年4月23日

Vulnerability Description

The login method in LoginModule implementations in Apache Geronimo 2.0 does not throw FailedLoginException for failed logins, which allows remote attackers to bypass authentication requirements, deploy arbitrary modules, and gain administrative access by sending a blank username and password with the command line deployer in the deployment module.

Affected Platforms (CPE)

📦

Apache

Geronimo

= 2.0

References & Advisories

🔗 http://geronimo.apache.org/2007/08/13/apache-geronimo-v20-release-delayed-due-to-security-issue.html

🔗 http://geronimo.apache.org/2007/08/21/apache-geronimo-201-released.html

🔗 http://www.nabble.com/Geronimo-2.0-Release-suspended-due-to-security-issue-found-before-release-t4263667s134.html

🔗 https://issues.apache.org/jira/browse/GERONIMO-1201

🔗 https://issues.apache.org/jira/browse/GERONIMO-3404

🔗 http://geronimo.apache.org/2007/08/13/apache-geronimo-v20-release-delayed-due-to-security-issue.html

🔗 http://geronimo.apache.org/2007/08/21/apache-geronimo-201-released.html

🔗 http://www.nabble.com/Geronimo-2.0-Release-suspended-due-to-security-issue-found-before-release-t4263667s134.html

関連する脆弱性情報

CVE-2013-177710.0

The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Community Ed...

CVE-2010-20769.8

Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Ch...

CVE-2008-55189.4

Multiple directory traversal vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2...

CVE-2011-50347.8

Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisi...