Advisory details:
github_osv / GHSA-w227-xcfx-3pj8
| Advisory ID | github_osv/GHSA-w227-xcfx-3pj8 |
| Aliases |
CVE-2009-0580
|
| Summary | Exposure of Sensitive Information in Apache Tomcat Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter. |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| generic_textual | MODERATE |
| Data source | Exploit-DB |
|---|---|
| Date added | June 3, 2009 |
| Description | Apache Tomcat 6.0.18 - Form Authentication Existing/Non-Existing 'Username' Enumeration |
| Ransomware campaign use | Known |
| Source publication date | June 3, 2009 |
| Exploit type | remote |
| Platform | multiple |
| Source update date | April 25, 2014 |
| Source URL | https://www.securityfocus.com/bid/35196/info |
| Data source | Metasploit |
|---|---|
| Description | This module enumerates Apache Tomcat's usernames via malformed requests to j_security_check, which can be found in the web administration package. It should work against Tomcat servers 4.1.0 - 4.1.39, 5.5.0 - 5.5.27, and 6.0.0 - 6.0.18. Newer versions no longer have the "admin" package by default. The 'admin' package is no longer provided for Tomcat 6 and later versions. |
| Note | {}
|
| Ransomware campaign use | Unknown |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/scanner/http/tomcat_enum.rb |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
There are no SSVC decisions available.