CVE-2009-3548

Apache Tomcat - Credentials Management

Title source: rule

Description

The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.

Exploits (4)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotemultiple
https://www.exploit-db.com/exploits/31433
metasploit WORKING POC EXCELLENT
rubypocjava
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_mgr_upload.rb
metasploit WORKING POC EXCELLENT
by jduck · rubypocjava
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_mgr_deploy.rb
exploitdb WORKING POC
rubyremotemultiple
https://www.exploit-db.com/exploits/16317

References (26)

... and 6 more

Scores

EPSS 0.8688
EPSS Percentile 99.4%

Details

CWE
CWE-255
Status published
Products (47)
apache/tomcat 3.0
apache/tomcat 3.1
apache/tomcat 3.1.1
apache/tomcat 3.2
apache/tomcat 3.2.1
apache/tomcat 3.2.2 (2 CPE variants)
apache/tomcat 3.2.3
apache/tomcat 3.2.4
apache/tomcat 3.3
apache/tomcat 3.3.1
... and 37 more
Published Nov 12, 2009
Tracked Since Feb 18, 2026