CVE Vulnerabilities

CVE-2007-5797

Improper Authentication

Published: Nov 03, 2007 | Modified: Mar 08, 2011
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu

SQLLoginModule in Apache Geronimo 2.0 through 2.1 does not throw an exception for a nonexistent username, which allows remote attackers to bypass authentication via a login attempt with any username not contained in the database.

Weakness

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Affected Software

Name Vendor Start Version End Version
Geronimo Apache 2.0 2.0
Geronimo Apache 2.1 2.1
Geronimo Apache 2.0.1 2.0.1
Geronimo Apache 2.0.2 2.0.2

Potential Mitigations

References