CVE-2009-3548: High severity Apache Tomcat vulnerability
Published Nov 12, 2009
·Updated
The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.
Affected Software
142 affected components
Apache Tomcat=3.0
Apache Tomcat=3.1
Apache Tomcat=3.1.1
Apache Tomcat=3.2
Apache Tomcat=3.2.1
Apache Tomcat=3.2.2
Apache Tomcat=3.2.2-beta2
Apache Tomcat=3.2.3
Apache Tomcat=3.2.4
Apache Tomcat=3.3
Apache Tomcat=3.3.1
Apache Tomcat=3.3.1a
Apache Tomcat=3.3.2
Apache Tomcat=4.0.0
Apache Tomcat=4.0.1
Apache Tomcat=4.0.2
Apache Tomcat=4.0.3
Apache Tomcat=4.0.4
Apache Tomcat=4.0.5
Apache Tomcat=4.0.6
Apache Tomcat=4.1.0
Apache Tomcat=4.1.1
Apache Tomcat=4.1.2
Apache Tomcat=4.1.3
Apache Tomcat=4.1.3-beta
Apache Tomcat=4.1.4
Apache Tomcat=4.1.5
Apache Tomcat=4.1.6
Apache Tomcat=4.1.7
Apache Tomcat=4.1.8
Apache Tomcat=4.1.9
Apache Tomcat=4.1.9-beta
Apache Tomcat=4.1.10
Apache Tomcat=4.1.11
Apache Tomcat=4.1.12
Apache Tomcat=4.1.13
Apache Tomcat=4.1.14
Apache Tomcat=4.1.15
Apache Tomcat=4.1.16
Apache Tomcat=4.1.17
Apache Tomcat=4.1.18
Apache Tomcat=4.1.19
Apache Tomcat=4.1.20
Apache Tomcat=4.1.21
Apache Tomcat=4.1.22
Apache Tomcat=4.1.23
Apache Tomcat=4.1.24
Apache Tomcat=4.1.25
Apache Tomcat=4.1.26
Apache Tomcat=4.1.27
Apache Tomcat=4.1.28
Apache Tomcat=4.1.29
Apache Tomcat=4.1.30
Apache Tomcat=4.1.31
Apache Tomcat=4.1.32
Apache Tomcat=4.1.33
Apache Tomcat=4.1.34
Apache Tomcat=4.1.35
Apache Tomcat=4.1.36
Apache Tomcat=4.1.37
Apache Tomcat=4.1.38
Apache Tomcat=4.1.39
Apache Tomcat=5.0.0
Apache Tomcat=5.0.1
Apache Tomcat=5.0.2
Apache Tomcat=5.0.3
Apache Tomcat=5.0.4
Apache Tomcat=5.0.5
Apache Tomcat=5.0.6
Apache Tomcat=5.0.7
Apache Tomcat=5.0.8
Apache Tomcat=5.0.9
Apache Tomcat=5.0.10
Apache Tomcat=5.0.11
Apache Tomcat=5.0.12
Apache Tomcat=5.0.13
Apache Tomcat=5.0.14
Apache Tomcat=5.0.15
Apache Tomcat=5.0.16
Apache Tomcat=5.0.17
Apache Tomcat=5.0.18
Apache Tomcat=5.0.19
Apache Tomcat=5.0.21
Apache Tomcat=5.0.22
Apache Tomcat=5.0.23
Apache Tomcat=5.0.24
Apache Tomcat=5.0.25
Apache Tomcat=5.0.26
Apache Tomcat=5.0.27
Apache Tomcat=5.0.28
Apache Tomcat=5.0.29
Apache Tomcat=5.0.30
Apache Tomcat=5.5.0
Apache Tomcat=5.5.1
Apache Tomcat=5.5.2
Apache Tomcat=5.5.3
Apache Tomcat=5.5.4
Apache Tomcat=5.5.5
Apache Tomcat=5.5.6
Apache Tomcat=5.5.7
Apache Tomcat=5.5.8
Apache Tomcat=5.5.9
Apache Tomcat=5.5.10
Apache Tomcat=5.5.11
Apache Tomcat=5.5.12
Apache Tomcat=5.5.13
Apache Tomcat=5.5.14
Apache Tomcat=5.5.15
Apache Tomcat=5.5.16
Apache Tomcat=5.5.17
Apache Tomcat=5.5.18
Apache Tomcat=5.5.19
Apache Tomcat=5.5.20
Apache Tomcat=5.5.21
Apache Tomcat=5.5.22
Apache Tomcat=5.5.23
Apache Tomcat=5.5.24
Apache Tomcat=5.5.25
Apache Tomcat=5.5.26
Apache Tomcat=5.5.27
Apache Tomcat=5.5.28
Apache Tomcat=6.0
Apache Tomcat=6.0.0
Apache Tomcat=6.0.1
Apache Tomcat=6.0.2
Apache Tomcat=6.0.3
Apache Tomcat=6.0.4
Apache Tomcat=6.0.5
Apache Tomcat=6.0.6
Apache Tomcat=6.0.7
Apache Tomcat=6.0.8
Apache Tomcat=6.0.9
Apache Tomcat=6.0.10
Apache Tomcat=6.0.11
Apache Tomcat=6.0.12
Apache Tomcat=6.0.13
Apache Tomcat=6.0.14
Apache Tomcat=6.0.15
Apache Tomcat=6.0.16
Apache Tomcat=6.0.17
Apache Tomcat=6.0.18
Apache Tomcat=6.0.20
Event History
Nov 12, 2009
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-3548?
CVE-2009-3548 has a high severity rating due to the risk of unauthorized access to administrative functions.
2
How do I fix CVE-2009-3548?
To fix CVE-2009-3548, configure a strong password for the administrative user in Apache Tomcat.
3
What versions are affected by CVE-2009-3548?
CVE-2009-3548 affects Apache Tomcat versions 6.0.0 through 6.0.20 and 5.5.0 through 5.5.28, among others.
4
What impact does CVE-2009-3548 have on applications?
CVE-2009-3548 allows remote attackers to gain administrative privileges, potentially compromising the application security.
5
Is there a workaround for CVE-2009-3548?
A workaround for CVE-2009-3548 is to disable the default administrative user account until a secure password can be configured.