Description
SQLLoginModule in Apache Geronimo 2.0 through 2.1 does not throw an exception for a nonexistent username, which allows remote attackers to bypass authentication via a login attempt with any username not contained in the database.
References
- ADV-2007-3676 vdb-entry
- 38662 vdb-entry
- http://www-1.ibm.com/support/docview.wss?uid=swg21286105
- 27482 third-party-advisory
- 26287 vdb-entry
- 27478 third-party-advisory
- https://issues.apache.org/jira/browse/GERONIMO-3543
- ADV-2007-3675 vdb-entry