CVE-2007-5797

Currently unrated

Key Information:

Vendor
Apache
Status
Geronimo
Vendor
CVE Published:
3 November 2007

Summary

SQLLoginModule in Apache Geronimo 2.0 through 2.1 does not throw an exception for a nonexistent username, which allows remote attackers to bypass authentication via a login attempt with any username not contained in the database.

References

http://www.vupen.com/english/advisories/2007/3676
vdb-entryx_refsource_VUPEN
http://osvdb.org/38662
vdb-entryx_refsource_OSVDB
http://www-1.ibm.com/support/docview.wss?uid=swg21286105
x_refsource_CONFIRM

EPSS Score

7% chance of being exploited in the next 30 days.

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.