CVE-2009-4189

HP Operations Manager - Remote Code Execution via Default Credentials and File Upload

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 4 public exploits for CVE-2009-4189. PoCs published by MC, jduck, including Metasploit module auxiliary/scanner/http/tomcat_mgr_login.

AI-analyzed exploit summary This Metasploit module attempts to brute-force login credentials for the Tomcat Application Manager by testing various default or weak credentials. It does not exploit a specific vulnerability but checks for weak authentication configurations referenced in multiple CVEs.

Description

HP Operations Manager has a default password of OvW*busr1 for the ovwebusr account, which allows remote attackers to execute arbitrary code via a session that uses the manager role to conduct unrestricted file upload attacks against the /manager servlet in the Tomcat servlet container. NOTE: this might overlap CVE-2009-3099 and CVE-2009-3843.

Exploits (4)

metasploit SCANNER
by MC · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/tomcat_mgr_login.rb

This Metasploit module attempts to brute-force login credentials for the Tomcat Application Manager by testing various default or weak credentials. It does not exploit a specific vulnerability but checks for weak authentication configurations referenced in multiple CVEs.

Classification
Scanner 100%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: Apache Tomcat (multiple versions)
Auth required
Prerequisites: Access to Tomcat Manager interface · List of default/weak credentials
devstral-2 · analyzed Jun 05, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
rubypocjava
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_mgr_upload.rb

This Metasploit module exploits Apache Tomcat's Manager application to upload and execute a malicious WAR archive via authenticated access. It handles CSRF tokens, session management, and payload deployment, targeting multiple platforms (Java, Windows, Linux).

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apache Tomcat (with exposed Manager application)
Auth required
Prerequisites: Valid Tomcat Manager credentials · Exposed /manager endpoint · Network access to target
devstral-2 · analyzed Apr 24, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by jduck · rubypocjava
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_mgr_deploy.rb

This Metasploit module exploits Apache Tomcat's Manager application to deploy a malicious WAR file containing a JSP payload, achieving remote code execution. It authenticates with provided credentials, uploads the payload via PUT request, triggers execution, and cleans up by undeploying the application.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apache Tomcat (versions with exposed Manager application)
Auth required
Prerequisites: Valid credentials for Tomcat Manager · Exposed Tomcat Manager interface (/manager)
devstral-2 · analyzed Apr 24, 2026 Full analysis →
exploitdb WORKING POC
rubyremotemultiple
https://www.exploit-db.com/exploits/16317

This Metasploit module exploits Apache Tomcat's Manager application to deploy a malicious WAR archive containing a JSP payload, achieving authenticated remote code execution. It supports automatic target detection and payload execution, followed by cleanup.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apache Tomcat (versions with exposed Manager application)
Auth required
Prerequisites: Valid credentials for Tomcat Manager · Exposed Manager application (/manager)
devstral-2 · analyzed Feb 19, 2026 Full analysis →

References (1)

Core 1
Core References
Various Sources x_refsource_misc
http://www.intevydis.com/blog/?p=87

Scores

EPSS 0.8349
EPSS Percentile 99.3%

Details

CWE
CWE-255
Status published
Products (1)
hp/operations_manager
Published Dec 03, 2009
Tracked Since Feb 18, 2026