The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default pass…

Published 16 y ago 2009-11-12 · modified 4 mo ago 2026-06-16 · JSON

CVSS

7.5

v2.0 · NVD

CISA KEV

not known exploited

EPSS

79.0%

percentile 100%

Public exploits

Metasploit · Exploit-DB

The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.

Exploit prediction (EPSS)

79.00% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

Metasploit exploit/multi/http/tomcat_mgr_upload Apache Tomcat Manager Authenticated Upload Code Execution · metasploit exploit, excellent rank · 2009-11-09
Metasploit exploit/multi/http/tomcat_mgr_deploy Apache Tomcat Manager Application Deployer Authenticated Code Execution · metasploit exploit, excellent rank · 2009-11-09
Metasploit auxiliary/scanner/http/tomcat_mgr_login Tomcat Application Manager Login Utility · metasploit auxiliary, normal rank
EDB-31433 Apache Tomcat Manager - Application Upload (Authenticated) Code Execution (Metasploit) · remote · 2014-02-05
EDB-16317 Apache Tomcat Manager - Application Deployer (Authenticated) Code Execution (Metasploit) · remote · 2010-12-14

CVSS scores

Assigned by	Version	Score	Vector
NVD	2.0	7.5	`AV:N/AC:L/Au:N/C:P/I:P/A:P`

Classification

Weakness

CWE-255 Credentials Management Errors

References

h20000.www2.hp.com /bizsupport/TechSupport/Document.jsp?objectID=c02241113 · vendor-advisory, x_refsource_HP, x_transferred
marc.info /?l=bugtraq&m=127420533226623&w=2 · vendor-advisory, x_refsource_HP, x_transferred
marc.info /?l=bugtraq&m=136485229118404&w=2 · vendor-advisory, x_refsource_HP, x_transferred
secunia.com /advisories/40330 · third-party-advisory, x_refsource_SECUNIA, x_transferred
vupen.com /english/advisories/2010/1559 · vdb-entry, x_refsource_VUPEN, x_transferred
oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19414 · vdb-entry, signature, x_refsource_OVAL, x_transferred
marc.info /?l=bugtraq&m=133469267822771&w=2 · vendor-advisory, x_refsource_HP, x_transferred
exchange.xforce.ibmcloud.com /vulnerabilities/54182 · vdb-entry, x_refsource_XF, x_transferred
tomcat.apache.org /security-6.html · x_refsource_CONFIRM, x_transferred
secunia.com /advisories/57126 · third-party-advisory, x_refsource_SECUNIA, x_transferred
vmware.com /support/vsphere4/doc/vsp_vc41_u1_rel_notes.html · x_refsource_CONFIRM, x_transferred
oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7033 · vdb-entry, signature, x_refsource_OVAL, x_transferred
securityfocus.com /bid/36954 · vdb-entry, x_refsource_BID, x_transferred
vupen.com /english/advisories/2009/3185 · vdb-entry, x_refsource_VUPEN, x_transferred
tomcat.apache.org /security-5.html · x_refsource_CONFIRM, x_transferred
vmware.com /security/advisories/VMSA-2011-0003.html · x_refsource_CONFIRM, x_transferred
securityfocus.com /archive/1/507720/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
markmail.org /thread/wfu4nff5chvkb6xp · x_refsource_MISC, x_transferred
securityfocus.com /archive/1/516397/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
marc.info /?l=bugtraq&m=139344343412337&w=2 · vendor-advisory, x_refsource_HP, x_transferred
securitytracker.com /id?1023146 · vdb-entry, x_refsource_SECTRACK, x_transferred
lists.apache.org /thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
lists.apache.org /thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
lists.apache.org /thread.html/df497a37fbf98e38d4c83e44829745fe9851b5fde928409c950f80e6%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
lists.apache.org /thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apa · mailing-list, x_refsource_MLIST, x_transferred
lists.apache.org /thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apa · mailing-list, x_refsource_MLIST, x_transferred

Sources

CVE List: CVE-2009-3548
NVD: CVE-2009-3548

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.