CVE-2010-4094

IBM Rational Quality Manager and Rational Test Lab Manager - Remote Code Execution via Default Tomcat ADMIN Password

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 4 public exploits for CVE-2010-4094. PoCs published by Metasploit, MC, jduck, including Metasploit module auxiliary/scanner/http/tomcat_mgr_login.

AI-analyzed exploit summary This Metasploit module exploits Apache Tomcat's Manager Application Deployer to achieve authenticated remote code execution by uploading a malicious WAR file containing a JSP payload. It supports automatic target detection and cleanup after execution.

Description

The Tomcat server in IBM Rational Quality Manager and Rational Test Lab Manager has a default password for the ADMIN account, which makes it easier for remote attackers to execute arbitrary code by leveraging access to the manager role. NOTE: this might overlap CVE-2009-3548.

Exploits (4)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotemultiple
https://www.exploit-db.com/exploits/16317

This Metasploit module exploits Apache Tomcat's Manager Application Deployer to achieve authenticated remote code execution by uploading a malicious WAR file containing a JSP payload. It supports automatic target detection and cleanup after execution.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apache Tomcat (versions with exposed manager application)
Auth required
Prerequisites: Valid credentials for Tomcat Manager · Exposed Tomcat Manager interface
devstral-2 · analyzed Feb 18, 2026 Full analysis →
metasploit SCANNER
by MC · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/tomcat_mgr_login.rb

This Metasploit module attempts to brute-force login credentials for the Tomcat Application Manager by testing various default or weak credentials. It does not exploit a specific vulnerability but checks for weak authentication configurations.

Classification
Scanner 100%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: Apache Tomcat (various versions)
Auth required
Prerequisites: Access to Tomcat Manager interface · List of default/weak credentials
devstral-2 · analyzed Jun 05, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
rubypocjava
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_mgr_upload.rb

This Metasploit module exploits Apache Tomcat's Manager application to upload and execute a malicious WAR archive containing a JSP payload. It authenticates with provided credentials, bypasses CSRF protection, and achieves remote code execution by deploying the payload.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apache Tomcat (versions with exposed Manager application)
Auth required
Prerequisites: Valid Tomcat Manager credentials · Exposed /manager/html/upload endpoint · Network access to the target
devstral-2 · analyzed Apr 24, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by jduck · rubypocjava
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_mgr_deploy.rb

This Metasploit module exploits Apache Tomcat's Manager application to deploy a malicious WAR file containing a JSP payload, achieving remote code execution. It supports multiple platforms (Java, Windows, Linux) and includes functionality for automatic target detection and cleanup.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apache Tomcat (versions with exposed Manager application)
Auth required
Prerequisites: Valid credentials for Tomcat Manager · Exposed Tomcat Manager application
devstral-2 · analyzed Apr 24, 2026 Full analysis →

References (7)

Core 7
Core References
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2010/2732
Third Party Advisory x_refsource_misc
http://www.zerodayinitiative.com/advisories/ZDI-10-214/
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/44172
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1024601
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/41784
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/69008

Scores

EPSS 0.8416
EPSS Percentile 99.3%

Details

CWE
CWE-255
Status published
Products (2)
ibm/rational_quality_manager
ibm/rational_test_lab_manager
Published Oct 26, 2010
Tracked Since Feb 18, 2026