Login Request a demo
Unscored severity · published Nov 3, 2007
CVE-2007-5797
SQLLoginModule in Apache Geronimo 2.0 through 2.1 does not throw an exception for a nonexistent username, which allows remote attackers to bypass authentication via a login…
–
CVSS
3.1%
EPSS
No
On KEV
Description
SQLLoginModule in Apache Geronimo 2.0 through 2.1 does not throw an exception for a nonexistent username, which allows remote attackers to bypass authentication via a login attempt with any username not contained in the database.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.1% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GE
Geronimo · Apache
2.0; 2.0.1; 2.0.2; 2.1 · source: NVD
Affected product
GE
Geronimo
Apache
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-5797
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-5797
osvdb.org
http://osvdb.org/38662
secunia.com
http://secunia.com/advisories/27478
Vendor Advisory
http://secunia.com/advisories/27482
www-1.ibm.com
http://www-1.ibm.com/support/docview.wss?uid=swg21286105
www.securityfocus.com
http://www.securityfocus.com/bid/26287
www.vupen.com
http://www.vupen.com/english/advisories/2007/3675
More from Geronimo
–
CVE-2013-1777
The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Community Edition 3.0.0.3 and other products, does not…
–
CVE-2011-5034
Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to…
–
CVE-2009-0039
Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to…
–
CVE-2009-0038
Multiple cross-site scripting (XSS) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject…
–
CVE-2008-5518
Multiple directory traversal vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 on Windows allow remote attackers to upload…