Search for vulnerabilities
| Vulnerability ID | VCID-z5u6-pv6z-aqcx |
| Aliases |
CVE-2009-0580
GHSA-w227-xcfx-3pj8 |
| Summary | |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 6.2 |
| Risk | 10.0 |
| Affected and Fixed Packages | Package Details |
| Data source | Exploit-DB |
|---|---|
| Date added | June 3, 2009 |
| Description | Apache Tomcat 6.0.18 - Form Authentication Existing/Non-Existing 'Username' Enumeration |
| Ransomware campaign use | Known |
| Source publication date | June 3, 2009 |
| Exploit type | remote |
| Platform | multiple |
| Source update date | April 25, 2014 |
| Source URL | https://www.securityfocus.com/bid/35196/info |
| Data source | Metasploit |
|---|---|
| Description | This module enumerates Apache Tomcat's usernames via malformed requests to j_security_check, which can be found in the web administration package. It should work against Tomcat servers 4.1.0 - 4.1.39, 5.5.0 - 5.5.27, and 6.0.0 - 6.0.18. Newer versions no longer have the "admin" package by default. The 'admin' package is no longer provided for Tomcat 6 and later versions. |
| Note | {}
|
| Ransomware campaign use | Unknown |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/scanner/http/tomcat_enum.rb |
| Percentile | 0.99282 |
| EPSS Score | 0.84435 |
| Published At | Sept. 25, 2025, 12:55 p.m. |
| Date | Actor | Action | Source | VulnerableCode Version |
|---|---|---|---|---|
| 2025-07-31T08:03:28.350825+00:00 | Apache Tomcat Importer | Import | https://tomcat.apache.org/security-6.html | 37.0.0 |