← back
CVE-2009-3548

CVE-2009-3548

60Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 79%
from disclosure to weapon397 days
Published on NVDNov 12
1st PoC+397d
metasploitNov 9
exploitation probability
79%top 1% of all CVEs
observed exploitation
nono source reports it
2 public exploit(s)
The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.
Affected products
n/a · n/a
public PoCs found — 2
exploitdbwww.exploit-db.com/exploits/16317unverifiedexploitdbwww.exploit-db.com/exploits/31433unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02241113http://marc.info/?l=bugtraq&m=127420533226623&w=2http://marc.info/?l=bugtraq&m=133469267822771&w=2http://marc.info/?l=bugtraq&m=136485229118404&w=2http://marc.info/?l=bugtraq&m=139344343412337&w=2http://markmail.org/thread/wfu4nff5chvkb6xphttp://secunia.com/advisories/40330http://secunia.com/advisories/57126https://exchange.xforce.ibmcloud.com/vulnerabilities/54182https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/df497a37fbf98e38d4c83e44829745fe9851b5fde928409c950f80e6%40%3Cdev.tomcat.apache.org%3E