Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-hjfh-7c4v-7q8h
Advisory ID github_osv/GHSA-hjfh-7c4v-7q8h
Aliases CVE-2009-2901
Summary Improper Authentication in Apache Tomcat The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-287 Improper Authentication
System Score Found at
generic_textual MODERATE
Reference id Reference type URL
http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html
http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html
http://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html
http://marc.info/?l=bugtraq&m=127420533226623&w=2
http://marc.info/?l=bugtraq&m=133469267822771&w=2
http://marc.info/?l=bugtraq&m=139344343412337&w=2
https://exchange.xforce.ibmcloud.com/vulnerabilities/55856
https://github.com/apache/tomcat
https://github.com/apache/tomcat55/commit/0299cb724ea71f304d54adfcdb950f59b01fb421
https://github.com/apache/tomcat/commit/3e1010b1a2f648581fac3d68afbf18f2979f6bf6
https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5@%3Cdev.tomcat.apache.org%3E
https://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
http://support.apple.com/kb/HT4077
http://svn.apache.org/viewvc?rev=892815&view=rev
http://svn.apache.org/viewvc?rev=902650&view=rev
http://tomcat.apache.org/security-5.html
http://tomcat.apache.org/security-6.html
http://ubuntu.com/usn/usn-899-1
CVE-2009-2901 https://nvd.nist.gov/vuln/detail/CVE-2009-2901
msg00001.html Advisory http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html
VMSA-2011-0003.html Other http://www.vmware.com/security/advisories/VMSA-2011-0003.html
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.