Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-vm4b-26sq-tfev
Vulnerability ID VCID-vm4b-26sq-tfev
Aliases CVE-2009-3548
Summary The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.
Status Published
Exploitability 2.0
Weighted Severity 2.7
Risk 5.4
Affected and Fixed Packages Package Details
Weaknesses (0)
There are no known CWE.
System Score Found at
epss 0.86884 https://api.first.org/data/v1/epss?cve=CVE-2009-3548
epss 0.86884 https://api.first.org/data/v1/epss?cve=CVE-2009-3548
epss 0.86884 https://api.first.org/data/v1/epss?cve=CVE-2009-3548
epss 0.86884 https://api.first.org/data/v1/epss?cve=CVE-2009-3548
epss 0.86884 https://api.first.org/data/v1/epss?cve=CVE-2009-3548
epss 0.86884 https://api.first.org/data/v1/epss?cve=CVE-2009-3548
epss 0.86884 https://api.first.org/data/v1/epss?cve=CVE-2009-3548
apache_tomcat Low https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3548
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2009-3548
https://svn.apache.org/viewvc?view=rev&rev=881771
https://svn.apache.org/viewvc?view=rev&rev=919006
CVE-2009-3548 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3548
CVE-2009-3548;OSVDB-60176 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/31433.rb
CVE-2010-4094;CVE-2010-0557;CVE-2009-4189;CVE-2009-4188;CVE-2009-3843;CVE-2009-3548;OSVDB-60670;OSVDB-60317;OSVDB-60176 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/16317.rb
CVE-2010-4094;CVE-2010-0557;CVE-2009-4189;CVE-2009-4188;CVE-2009-3843;CVE-2009-3548;OSVDB-60670;OSVDB-60317;OSVDB-60176 Exploit http://www.zerodayinitiative.com/advisories/ZDI-10-214/
Data source Exploit-DB
Date added Feb. 5, 2014
Description Apache Tomcat Manager - Application Upload (Authenticated) Code Execution (Metasploit)
Ransomware campaign use Known
Source publication date Feb. 5, 2014
Exploit type remote
Platform multiple
Source update date Feb. 5, 2014
Data source Metasploit
Description This module can be used to execute a payload on Apache Tomcat servers that have an exposed "manager" application. The payload is uploaded as a WAR archive containing a jsp application using a POST request against the /manager/html/upload component. NOTE: The compatible payload sets vary based on the selected target. For example, you must select the Windows target to use native Windows payloads.
Note 
Reliability:
  - unknown-reliability
Stability:
  - unknown-stability
SideEffects:
  - unknown-side-effects
Ransomware campaign use Unknown
Source publication date Nov. 9, 2009
Platform Java,Linux,Windows
Source URL https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/tomcat_mgr_upload.rb
Exploit Prediction Scoring System (EPSS)
Percentile 0.99425
EPSS Score 0.86884
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:38:17.388578+00:00 Apache Tomcat Importer Import https://tomcat.apache.org/security-6.html 38.0.0