CVE-2009-0580

CVSS V2 Medium 4.3 CVSS V3 None
Description
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter.
Overview
  • CVE ID
  • CVE-2009-0580
  • Assigner
  • secalert@redhat.com
  • Vulnerability Status
  • Modified
  • Published Version
  • 2009-06-05T16:00:00
  • Last Modified Date
  • 2023-02-13T02:19:39
Weakness Enumerations
CWE URL
CWE-200 http://cwe.mitre.org/data/definitions/200.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:apache:tomcat:4.1.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.3:beta:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.7:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.8:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.9:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.9:beta:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.10:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.11:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.12:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.13:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.14:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.15:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.16:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.17:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.18:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.19:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.20:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.21:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.22:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.23:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.24:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.25:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.26:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.27:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.28:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.29:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.30:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.31:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.32:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.33:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.34:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.35:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.36:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.37:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.38:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:4.1.39:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:5.5.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:5.5.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:5.5.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:5.5.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:5.5.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:5.5.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:5.5.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:5.5.7:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:5.5.8:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:5.5.9:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:5.5.10:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:5.5.11:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:5.5.12:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:5.5.13:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:5.5.14:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:5.5.15:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:5.5.16:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:5.5.17:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:5.5.18:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:5.5.19:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:5.5.20:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:5.5.21:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:5.5.22:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:5.5.23:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:5.5.24:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:5.5.25:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:5.5.26:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:5.5.27:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:M/Au:N/C:P/I:N/A:N
  • Access Vector
  • NETWORK
  • Access Compatibility
  • MEDIUM
  • Authentication
  • NONE
  • Confidentiality Impact
  • PARTIAL
  • Integrity Impact
  • NONE
  • Availability Impact
  • NONE
  • Base Score
  • 4.3
  • Severity
  • MEDIUM
  • Exploitability Score
  • 8.6
  • Impact Score
  • 2.9
References
Reference URL Reference Tags
http://svn.apache.org/viewvc?rev=747840&view=rev Patch Vendor Advisory
http://svn.apache.org/viewvc?rev=781379&view=rev Patch Vendor Advisory
http://www.securityfocus.com/bid/35196
http://tomcat.apache.org/security-6.html Patch Vendor Advisory
http://tomcat.apache.org/security-5.html Patch Vendor Advisory
http://secunia.com/advisories/35326 Vendor Advisory
http://secunia.com/advisories/35344 Vendor Advisory
http://securitytracker.com/id?1022332
http://tomcat.apache.org/security-4.html Patch Vendor Advisory
http://www.vupen.com/english/advisories/2009/1496 Patch Vendor Advisory
http://svn.apache.org/viewvc?rev=781382&view=rev Patch Vendor Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2009:138
http://www.mandriva.com/security/advisories?name=MDVSA-2009:136
http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html
http://www.vupen.com/english/advisories/2009/1856
http://secunia.com/advisories/35685
http://sunsolve.sun.com/search/document.do?assetkey=1-26-263529-1
http://secunia.com/advisories/35788
https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01216.html
http://www.vupen.com/english/advisories/2009/3316
http://secunia.com/advisories/37460
https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01246.html
http://www.vmware.com/security/advisories/VMSA-2009-0016.html
https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01156.html
http://support.apple.com/kb/HT4077
http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
http://www.mandriva.com/security/advisories?name=MDVSA-2010:176
http://marc.info/?l=bugtraq&m=129070310906557&w=2
http://www.vupen.com/english/advisories/2010/3056
http://secunia.com/advisories/42368
http://www.debian.org/security/2011/dsa-2207
http://marc.info/?l=bugtraq&m=136485229118404&w=2
http://marc.info/?l=bugtraq&m=133469267822771&w=2
http://marc.info/?l=bugtraq&m=127420533226623&w=2
https://exchange.xforce.ibmcloud.com/vulnerabilities/50930
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9101
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6628
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18915
http://www.securityfocus.com/archive/1/507985/100/0/threaded
http://www.securityfocus.com/archive/1/504125/100/0/threaded
http://www.securityfocus.com/archive/1/504108/100/0/threaded
http://www.securityfocus.com/archive/1/504045/100/0/threaded
https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2009-0580
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0580
History
Created Old Value New Value Data Type Notes
2022-05-10 17:45:48 Added to TrackCVE
2023-02-13 03:03:05 2023-02-13T02:19:39 CVE Modified Date updated