PT-2007-5719 · Apache · Apache Geronimo

Donald Woods · Published 2007-08-27 · Updated 2008-09-05 · CVE-2007-4548

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Geronimo version 2.0

Description The issue concerns the login method in LoginModule implementations, which does not properly handle failed logins by not throwing a FailedLoginException. This allows remote attackers to bypass authentication requirements. Attackers can exploit this by sending a blank username and password, potentially allowing them to deploy arbitrary modules and gain administrative access.

Recommendations For Apache Geronimo version 2.0, consider implementing a custom LoginModule that correctly throws a FailedLoginException for failed logins as a temporary workaround. Restrict access to the deployment module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2007-4548

Affected Products

Apache Geronimo

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2007-4548 · Security Note
• https://issues.apache.org/jira/browse/GERONIMO-3404 · Patch
• http://nabble.com/Geronimo-2.0-Release-suspended-due-to-security-issue-found-before-release-t4263667s134.html · Note
• http://geronimo.apache.org/2007/08/21/apache-geronimo-201-released.html · Note
• https://issues.apache.org/jira/browse/GERONIMO-1201 · Note
• http://geronimo.apache.org/2007/08/13/apache-geronimo-v20-release-delayed-due-to-security-issue.html · Note