CVE-2009-0580 Public exploit EPSS 94.4%

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used…

Summary

Apache Tomcat versions 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 contain improper error checking in the MemoryRealm, DataSourceRealm, and JDBCRealm authentication realms when FORM authentication is used. A remote attacker who can send requests to /j_security_check can enumerate valid usernames by submitting malformed URL encoding in the j_password parameter, such as a lone % character, without needing prior authentication.

Official description · CVE.org

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter.

Breakdown

25.0 / 100

Exploited: Not confirmed
Reports: 0
Tactics: 0/15

Public exploit code (Exploit-DB) was available 2 days before disclosure.

Public exploit codeExploit-DB3 Jun 20092 days before
Disclosed5 Jun 2009day 0

7 fixes in tomcat over 12 months. The latest fix listed for tomcat is 6.0.20.

Fixes in tomcatMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

6.0.18CVE-2008-19474 Jun 2008
6.0.18CVE-2008-23704 Aug 2008
6.0.18CVE-2008-293813 Aug 2008
6.0.19CVE-2009-05805 Jun 2009
6.0.20CVE-2009-07819 Mar 2009
6.0.20CVE-2009-07835 Jun 2009
6.0.20CVE-2008-551516 Jun 2009Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.apache.tomcat:tomcat.

Mavenorg.apache.tomcat:tomcatGHSA-w227-xcfx-3pj8

Upgrade to 6.0.35 or later

Fixes this CVE and 8 other known vulnerabilities in this package (CVE-2007-0450, CVE-2007-2449, +6).

Set the version to 6.0.35 or later in your pom.xml or build.gradle.

First fixed in 6.0.19 for CVE-2009-0580.

Affected versions, by release line

If you run	Upgrade to
6.0.0 up to 6.0.19	6.0.35first fix for this CVE: 6.0.19
5.0.0 up to 5.5.28	5.5.35first fix for this CVE: 5.5.28
4.1.0 up to 4.1.40	4.1.40

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

49 links, grouped by NVD tag

Show 6 moreShow fewer

redhat.com/archives/fedora-package-announce/2009-November/msg01156.html redhat.com/archives/fedora-package-announce/2009-November/msg01216.html lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html marc.info/?l=bugtraq&m=129070310906557&w=2 mandriva.com/security/advisories?name=MDVSA-2009:136 sunsolve.sun.com/search/document.do?assetkey=1-26-263529-1

third-party-advisory 6

secunia.com/advisories/35326 secunia.com/advisories/35344 secunia.com/advisories/37460 secunia.com/advisories/35788 secunia.com/advisories/42368 secunia.com/advisories/35685

mailing-list 11

securityfocus.com/archive/1/504125/100/0/threaded securityfocus.com/archive/1/504045/100/0/threaded securityfocus.com/archive/1/504108/100/0/threaded securityfocus.com/archive/1/507985/100/0/threaded lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E

Show 3 moreShow fewer

lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2022-5460

Apache Tomcat 6.0.18 - Form Authentication Existing/Non-Existing 'Username' EnumerationEDB-33023 · remote · multiple · 2009-06-03 · verified

, 31 Oct 2026

94.4%Top 0.15%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.85%).

No CVSS score published.

Priority factorsFormula

In a KEV catalognot listed 0.0/35

Recent KEV listingnot listed 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9985 20.0/20

Threat reports0 reports 0.0/10

Public exploit code1 Exploit-DB entry; 1 Metasploit module 5.0/5

Mentioned in OTX pulses0 pulses 0.0/3

CVSS base scoreno CVSS 0.0/7

End-of-life productsupported or unknown 0.0

Total25.0

Record

Published: 5 Jun 2009
Modified: 7 Aug 2024
: None assigned
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Fixes in tomcatMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques