Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2009-0580 — Sensitive Information Exposure in Apache Tomcat

CWE-200 — Sensitive Information Exposure10 documents8 sources
Severity
4.3MEDIUMNVD
EPSS
88.2%
top 0.51%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Apache Tomcat
Timeline
PublishedJun 5
Latest updateMay 2

Description

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter.

CVSS vector

AV:N/AC:M/C:P/I:N/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages1 packages

▶NVDapache/tomcat85 versions+84

Patches

Patch: svn.apache.org ↗Patch: svn.apache.org ↗Patch: svn.apache.org ↗

🔴Vulnerability Details

3
OSV
Exposure of Sensitive Information in Apache Tomcat↗2022-05-02
▶
GHSA
Exposure of Sensitive Information in Apache Tomcat↗2022-05-02
▶
CVEList
CVE-2009-0580: Apache Tomcat 4↗2009-06-05
▶

💥Exploits & PoCs

1
Exploit-DB
Apache Tomcat 6.0.18 - Form Authentication Existing/Non-Existing 'Username' Enumeration↗2009-06-03
▶

📋Vendor Advisories

2
Ubuntu
Tomcat vulnerabilities↗2009-06-15
▶
Red Hat
tomcat6 Information disclosure in authentication classes↗2009-06-03
▶

💬Community

3
Bugzilla
CVE-2009-2696 tomcat: missing fix for CVE-2009-0781↗2010-07-21
▶
Bugzilla
CVE-2009-0033 CVE-2009-0580 CVE-2009-0783 CVE-2008-5515 CVE-2009-0781 Multiple tomcat5 vulnerabilities [Fedora all]↗2009-11-09
▶
Bugzilla
CVE-2009-0580 tomcat6 Information disclosure in authentication classes↗2009-06-03
▶
CVE-2009-0580 — Sensitive Information Exposure | cvebase