CVE-2009-0580: Infoleak
Published Jun 5, 2009
·Updated
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /jsecuritycheck with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the jpassword parameter.
Affected Software
87 affected components
Apache Tomcat=4.1.0
Apache Tomcat=4.1.1
Apache Tomcat=4.1.2
Apache Tomcat=4.1.3
Apache Tomcat=4.1.3-beta
Apache Tomcat=4.1.4
Apache Tomcat=4.1.5
Apache Tomcat=4.1.6
Apache Tomcat=4.1.7
Apache Tomcat=4.1.8
Apache Tomcat=4.1.9
Apache Tomcat=4.1.9-beta
Apache Tomcat=4.1.10
Apache Tomcat=4.1.11
Apache Tomcat=4.1.12
Apache Tomcat=4.1.13
Apache Tomcat=4.1.14
Apache Tomcat=4.1.15
Apache Tomcat=4.1.16
Apache Tomcat=4.1.17
Apache Tomcat=4.1.18
Apache Tomcat=4.1.19
Apache Tomcat=4.1.20
Apache Tomcat=4.1.21
Apache Tomcat=4.1.22
Apache Tomcat=4.1.23
Apache Tomcat=4.1.24
Apache Tomcat=4.1.25
Apache Tomcat=4.1.26
Apache Tomcat=4.1.27
Apache Tomcat=4.1.28
Apache Tomcat=4.1.29
Apache Tomcat=4.1.30
Apache Tomcat=4.1.31
Apache Tomcat=4.1.32
Apache Tomcat=4.1.33
Apache Tomcat=4.1.34
Apache Tomcat=4.1.35
Apache Tomcat=4.1.36
Apache Tomcat=4.1.37
Apache Tomcat=4.1.38
Apache Tomcat=4.1.39
Apache Tomcat=5.5.0
Apache Tomcat=5.5.1
Apache Tomcat=5.5.2
Apache Tomcat=5.5.3
Apache Tomcat=5.5.4
Apache Tomcat=5.5.5
Apache Tomcat=5.5.6
Apache Tomcat=5.5.7
Apache Tomcat=5.5.8
Apache Tomcat=5.5.9
Apache Tomcat=5.5.10
Apache Tomcat=5.5.11
Apache Tomcat=5.5.12
Apache Tomcat=5.5.13
Apache Tomcat=5.5.14
Apache Tomcat=5.5.15
Apache Tomcat=5.5.16
Apache Tomcat=5.5.17
Apache Tomcat=5.5.18
Apache Tomcat=5.5.19
Apache Tomcat=5.5.20
Apache Tomcat=5.5.21
Apache Tomcat=5.5.22
Apache Tomcat=5.5.23
Apache Tomcat=5.5.24
Apache Tomcat=5.5.25
Apache Tomcat=5.5.26
Apache Tomcat=5.5.27
Apache Tomcat=6.0.0
Apache Tomcat=6.0.1
Apache Tomcat=6.0.2
Apache Tomcat=6.0.3
Apache Tomcat=6.0.4
Apache Tomcat=6.0.5
Apache Tomcat=6.0.6
Apache Tomcat=6.0.7
Apache Tomcat=6.0.8
Apache Tomcat=6.0.9
Apache Tomcat=6.0.10
Apache Tomcat=6.0.11
Apache Tomcat=6.0.12
Apache Tomcat=6.0.13
Apache Tomcat=6.0.14
Apache Tomcat=6.0.15
Apache Tomcat=6.0.16
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Jun 5, 2009
CVE Published
via MITRE·03:25 PM
Data Sourced
via MITRE·03:25 PM
Description
Frequently Asked Questions
1
How can remote attackers exploit CVE-2009-0580?
Remote attackers can exploit CVE-2009-0580 by sending requests to /j_security_check with malformed URL encoding of passwords.