CVE-2009-3548

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 79.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-11-12 · updated 2026-06-16
Weakness: CWE-255

Description

The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.

Affected products

Apache Tomcat: 3.0, 3.1, 3.1.1, 3.2, 3.2.1, 3.2.2 (+136)

References

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02241113
http://marc.info/?l=bugtraq&m=127420533226623&w=2
http://marc.info/?l=bugtraq&m=133469267822771&w=2
http://marc.info/?l=bugtraq&m=136485229118404&w=2
http://marc.info/?l=bugtraq&m=139344343412337&w=2
http://markmail.org/thread/wfu4nff5chvkb6xp
http://secunia.com/advisories/40330
http://secunia.com/advisories/57126
http://tomcat.apache.org/security-5.html
http://tomcat.apache.org/security-6.html
http://www.securityfocus.com/archive/1/507720/100/0/threaded
http://www.securityfocus.com/archive/1/516397/100/0/threaded

Get alerted when CVE-2009-3548 or the next vulnerability affects your stack