CVEvulnerability

CVE-2009-0580

4.3 MEDIUM Published 2009-06-05 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2009-06-05
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
Weaknesses
CWE-200

Description

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter.

Affected configurations

• apache tomcat 4.1.0 • apache tomcat 4.1.1 • apache tomcat 4.1.2 • apache tomcat 4.1.3 • apache tomcat 4.1.4 • apache tomcat 4.1.5 • apache tomcat 4.1.6 • apache tomcat 4.1.7 • apache tomcat 4.1.8 • apache tomcat 4.1.9 • apache tomcat 4.1.10 • apache tomcat 4.1.11 • apache tomcat 4.1.12 • apache tomcat 4.1.13 • apache tomcat 4.1.14 • apache tomcat 4.1.15 • apache tomcat 4.1.16 • apache tomcat 4.1.17 • apache tomcat 4.1.18 • apache tomcat 4.1.19 • apache tomcat 4.1.20 • apache tomcat 4.1.21 • apache tomcat 4.1.22 • apache tomcat 4.1.23 • apache tomcat 4.1.24 • apache tomcat 4.1.25 • apache tomcat 4.1.26 • apache tomcat 4.1.27 • apache tomcat 4.1.28 • apache tomcat 4.1.29 • apache tomcat 4.1.30 • apache tomcat 4.1.31 • apache tomcat 4.1.32 • apache tomcat 4.1.33 • apache tomcat 4.1.34 • apache tomcat 4.1.35 • apache tomcat 4.1.36 • apache tomcat 4.1.37 • apache tomcat 4.1.38 • apache tomcat 4.1.39 • apache tomcat 5.5.0 • apache tomcat 5.5.1 • apache tomcat 5.5.2 • apache tomcat 5.5.3 • apache tomcat 5.5.4 • apache tomcat 5.5.5 • apache tomcat 5.5.6 • apache tomcat 5.5.7 • apache tomcat 5.5.8 • apache tomcat 5.5.9 • apache tomcat 5.5.10 • apache tomcat 5.5.11 • apache tomcat 5.5.12 • apache tomcat 5.5.13 • apache tomcat 5.5.14 • apache tomcat 5.5.15 • apache tomcat 5.5.16 • apache tomcat 5.5.17 • apache tomcat 5.5.18 • apache tomcat 5.5.19 … and 25 more

Related

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References