Vulnerabilities
By Date By Type Known Exploited Assigners CVSS Scores EPSS Scores Search
Vulnerable Software
Vendors Products Version Search
Metasploit Modules CWE Definitions
Articles Blog

Vulnerability Details : CVE-2009-3548

The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.
Published 2009-11-12 23:30:01
Updated 2019-03-25 11:31:05
Source Red Hat, Inc.
View at NVD,   CVE.org
At least one public exploit which can be used to exploit this vulnerability exists!

Exploit prediction scoring system (EPSS) score for CVE-2009-3548

Probability of exploitation activity in the next 30 days: 17.08%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 95 % EPSS Score History EPSS FAQ

Metasploit modules for CVE-2009-3548

  • Apache Tomcat Manager Application Deployer Authenticated Code Execution
    Disclosure Date : 2009-11-09
    exploit/multi/http/tomcat_mgr_deploy
    This module can be used to execute a payload on Apache Tomcat servers that have an exposed "manager" application. The payload is uploaded as a WAR archive containing a jsp application using a PUT request. The manager application can also be abused using /manager/html/upload, but that method is not implemented in this module. NOTE: The compatible payload sets vary based on the selected target. For example, you must select the Windows target to use native Windows payloads. Authors: - jduck <[email protected]>
  • Apache Tomcat Manager Authenticated Upload Code Execution
    Disclosure Date : 2009-11-09
    exploit/multi/http/tomcat_mgr_upload
    This module can be used to execute a payload on Apache Tomcat servers that have an exposed "manager" application. The payload is uploaded as a WAR archive containing a jsp application using a POST request against the /manager/html/upload component. NOTE: The compatible payload sets vary based on the selected target. For example, you must select the Windows target to use native Windows payloads. Authors: - rangercha
  • Tomcat Application Manager Login Utility
    auxiliary/scanner/http/tomcat_mgr_login
    This module simply attempts to login to a Tomcat Application Manager instance using a specific user/pass. Authors: - MC <[email protected]> - Matteo Cantoni <g[email protected]> - jduck <[email protected]>

CVSS scores for CVE-2009-3548

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Source
7.5
 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P
10.0
6.4
 [email protected]

CWE ids for CVE-2009-3548

References for CVE-2009-3548

Products affected by CVE-2009-3548

This web site uses cookies for managing your session and website analytics (Google analytics) purposes as described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close