CVE-2009-2901: Medium severity Apache Tomcat vulnerability
The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What versions are affected by CVE-2009-2901?
Apache Tomcat versions 5.5.0 to 5.5.28 and 6.0.0 to 6.0.20 are affected by CVE-2009-2901.
What is the severity of CVE-2009-2901?
CVE-2009-2901 is considered a medium severity vulnerability.
How do I fix CVE-2009-2901?
To fix CVE-2009-2901, upgrade Apache Tomcat to version 5.5.29 or later for 5.5.x and to version 6.0.24 or later for 6.0.x.
What type of vulnerability is CVE-2009-2901?
CVE-2009-2901 is an authentication bypass vulnerability due to improper handling of application files during the autodeployment process.
Can CVE-2009-2901 be exploited remotely?
Yes, CVE-2009-2901 can be exploited remotely if the affected versions have autoDeploy enabled.