CVE-2007-4548
The login method in LoginModule implementations in Apache Geronimo 2.0 does not throw...
The login method in LoginModule implementations in Apache Geronimo 2.0 does not throw FailedLoginException for failed logins, which allows remote attackers to bypass authentication requirements, deploy arbitrary modules, and gain administrative access by sending a blank username and password with the command line deployer in the deployment module.
Exploit likelihood
What each source reports
NVD Score used
The login method in LoginModule implementations in Apache Geronimo 2.0 does not throw FailedLoginException for failed logins, which allows remote attackers to bypass authentication requirements, deploy arbitrary modules, and gain administrative access by sending a blank username and password with the command line deployer in the deployment module.
- Record
CVE-2007-4548- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
The login method in LoginModule implementations in Apache Geronimo 2.0 does not throw FailedLoginException for failed logins, which allows remote attackers to bypass authentication requirements, deploy arbitrary modules, and gain administrative access by sending a blank username and password with the command line deployer in the deployment module.
- Record
CVE-2007-4548- Updated
- 2026-11-02
EUVDEUVD-2007-4531 No score
The login method in LoginModule implementations in Apache Geronimo 2.0 does not throw FailedLoginException for failed logins, which allows remote attackers to bypass authentication requirements, deploy arbitrary modules, and gain administrative access by sending a blank username and password with the command line deployer in the deployment module.
- Record
EUVD-2007-4531- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-552j-r9hx-pgwr No score
The login method in LoginModule implementations in Apache Geronimo 2.0 does not throw...
The login method in LoginModule implementations in Apache Geronimo 2.0 does not throw FailedLoginException for failed logins, which allows remote attackers to bypass authentication requirements, deploy arbitrary modules, and gain administrative access by sending a blank username and password with the command line deployer in the deployment module.
- Record
GHSA-552j-r9hx-pgwr- Weakness
- CWE-287
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| aliases, references, title | GitHub Advisories | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-4548 is a high vulnerability (CVSS 10.0) in Apache Geronimo, published August 27, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.19%, the 90th percentile. No source names a fixed version.
References
issues.apache.org/jira/browse/GERONIMO-3404
geronimo.apache.org/2007/08/13/apache-geronimo-v20-release-delayed-due-to-security-issue.html
nabble.com/Geronimo-2.0-Release-suspended-due-to-security-issue-found-before-release-t4263667s134.html
nvd.nist.gov/vuln/detail/CVE-2007-4548
github.com/advisories/GHSA-552j-r9hx-pgwr