PT-2007-5719 · Apache · Apache Geronimo

Donald Woods · Publicado 2007-08-27 · Atualizado 2008-09-05 · CVE-2007-4548

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Geronimo version 2.0

Description The issue concerns the login method in LoginModule implementations, which does not properly handle failed logins by not throwing a FailedLoginException. This allows remote attackers to bypass authentication requirements. Attackers can exploit this by sending a blank username and password, potentially allowing them to deploy arbitrary modules and gain administrative access.

Recommendations For Apache Geronimo version 2.0, consider implementing a custom LoginModule that correctly throws a FailedLoginException for failed logins as a temporary workaround. Restrict access to the deployment module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2007-4548

Produtos afetados

Apache Geronimo

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2007-4548 · Nota de Segurança
• http://nabble.com/Geronimo-2.0-Release-suspended-due-to-security-issue-found-before-release-t4263667s134.html · Nota
• http://geronimo.apache.org/2007/08/21/apache-geronimo-201-released.html · Nota
• https://issues.apache.org/jira/browse/GERONIMO-1201 · Nota
• https://issues.apache.org/jira/browse/GERONIMO-3404 · Correção
• http://geronimo.apache.org/2007/08/13/apache-geronimo-v20-release-delayed-due-to-security-issue.html · Nota