CVE-2009-3548
Apache Tomcat - Credentials Management
Title source: ruleDescription
The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.
Exploits (4)
exploitdb
WORKING POC
VERIFIED
by Metasploit · rubyremotemultiple
https://www.exploit-db.com/exploits/31433
metasploit
WORKING POC
EXCELLENT
rubypocjava
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_mgr_upload.rb
metasploit
WORKING POC
EXCELLENT
by jduck · rubypocjava
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_mgr_deploy.rb
References (26)
... and 6 more
Scores
EPSS
0.8688
EPSS Percentile
99.4%
Details
CWE
CWE-255
Status
published
Products (47)
apache/tomcat
3.0
apache/tomcat
3.1
apache/tomcat
3.1.1
apache/tomcat
3.2
apache/tomcat
3.2.1
apache/tomcat
3.2.2 (2 CPE variants)
apache/tomcat
3.2.3
apache/tomcat
3.2.4
apache/tomcat
3.3
apache/tomcat
3.3.1
... and 37 more
Published
Nov 12, 2009
Tracked Since
Feb 18, 2026