$ cve CVE-2009-0580 JSON

CVE-2009-0580 EXPLOIT

4.3

MEDIUM · CVSS 2.0 · EPSS 94.4% (pctl 100)

Patch early

A public exploit exists.

Description

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter.

Scoring

CVSS	4.3 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:P/I:N/A:N
EPSS	94.44% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-200
On CISA KEV	no
Public exploit	yes
Published	2009-06-05
Last modified	2026-06-16

Affected (1)

Vendor	Product
apache	tomcat

Public exploits

Source	Title	Date
exploit-db	Apache Tomcat 6.0.18 - Form Authentication Existing/Non-Existing 'Username' Enumeration	2009-06-03

References

→ the Explorer · watch your stack · NVD