CVE-2007-5797 SQLLoginModule in Apache Geronimo 2.0 through 2.1 does not throw an exception for a nonexistent username, which allows remote attackers to bypass authentication via a login attempt with any username n...
HighCVSS 7.5
EPSS 3.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SQLLoginModule in Apache Geronimo 2.0 through 2.1 does not throw an exception for a nonexistent username, which allows remote attackers to bypass authentication via a login attempt with any username not contained in the database.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache geronimo | = 2.0 | No fix listed |
| apache geronimo | = 2.0.1 | No fix listed |
| apache geronimo | = 2.0.2 | No fix listed |
| apache geronimo | = 2.1 | No fix listed |
References
- 38662 vdb-entry
- 27478 third-party-advisory
- 27482 third-party-advisory vendor-advisory
- www-1.ibm.com
- 26287 vdb-entry
- ADV-2007-3675 vdb-entry
- ADV-2007-3676 vdb-entry
- issues.apache.org