Description
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | tomcat5.5 | 5.5.26-5lenny2 | DSA-2207-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | tomcat5 +10 | 5.5.23-0jpp.7.el5_3.2 | RHSA-2009:1164 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Developer Suite 3 | tomcat5 +5 | 5.5.23-0jpp_18rh | RHSA-2009:1563 |
| Red Hat Rhel Application Server 2 | tomcat5 +10 | 5.5.23-0jpp_4rh.16 | RHSA-2009:1562 |
| Red Hat Network Satellite 5 | tomcat5 +5 | 5.5.23-0jpp_18rh | RHSA-2009:1616 |
| Red Hat JBoss Web Server 1 | tomcat5 +10 | 5.5.23-0jpp.9.6.ep5.el5 | RHSA-2009:1454 |
| Red Hat JBoss Web Server 1 | tomcat6 +9 | 6.0.18-11.3.ep5.el4 | RHSA-2009:1506 |
| Red Hat JBoss EAP 4 | glassfish-jaxb +1 | 2.1.4-1.11.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145 |
| Red Hat JBoss EAP 4 | hibernate3 +1 | 1:3.2.4-1.SP1_CP08.0jpp.ep1.2.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | hibernate3-annotations +1 | 3.3.1-1.10.GA_CP01.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | hibernate3-commons-annotations +1 | 3.0.0-1jpp.ep1.5.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | hibernate3-entitymanager +1 | 3.3.2-2.4.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | hibernate3-validator +1 | 3.0.0-1jpp.ep1.8.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | hsqldb | 1:1.8.0.8-2.patch02.1jpp.ep1.2.el4 | RHSA-2009:1146, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | jakarta-slide-webdavclient | 2.1-9.2.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | jboss-cache | 1.4.1-6.SP13.1.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | jboss-messaging | 1.4.0-2.SP3_CP08.1.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145 |
| Red Hat JBoss EAP 4 | jboss-remoting | 2.2.3-2.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | jboss-seam +1 | 1.2.1-1.ep1.13.el5 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | jbossas +2 | 4.2.0-4.GA_CP07.5.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | jbossas-4.3.0.GA_CP05-bin | 4.3.0-4.GA_CP05.6.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145 |
| Red Hat JBoss EAP 4 | jbossts | 1:4.2.3-1.SP5_CP05.1jpp.ep1.1.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | jbossweb | 2.0.0-6.CP11.0jpp.ep1.1.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | jbossws +1 | 2.0.1-3.SP2_CP06.3.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145 |
| Red Hat JBoss EAP 4 | jbossws-common | 1.0.0-2.GA_CP04.1.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145 |
| Red Hat JBoss EAP 4 | jbossws-framework | 2.0.1-1.GA_CP04.2.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145 |
| Red Hat JBoss EAP 4 | jbossws-spi | 1.0.0-1.GA_CP02.1.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145 |
| Red Hat JBoss EAP 4 | jgroups | 1:2.4.6-1.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | rh-eap-docs +1 | 4.2.0-5.GA_CP07.ep1.1.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | xerces-j2 | 2.7.1-9jpp.ep1.2.el4 | RHSA-2009:1146, RHSA-2009:1144 |
| Red Hat Certificate System 7 | ant | 1.6.5-1jpp_1rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | avalon-logkit | 1.2-2jpp_4rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | axis | 1.2.1-1jpp_3rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | classpathx-jaf | 1.0-2jpp_6rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | classpathx-mail | 1.1.1-2jpp_8rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | geronimo-specs +10 | 1.0-0.M4.1jpp_10rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | jakarta-commons-modeler | 2.0-3jpp_2rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | log4j | 1.2.12-1jpp_1rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | mx4j | 1:3.0.1-1jpp_4rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | pcsc-lite +2 | 1.3.3-3.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-ca | 7.3.0-20.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-java-tools | 7.3.0-10.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-kra | 7.3.0-14.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-manage | 7.3.0-19.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-native-tools | 7.3.0-6.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-tks +1 | 7.3.0-13.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | tomcat5 +5 | 5.5.23-0jpp_4rh.16 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | xerces-j2 | 2.7.1-1jpp_1rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | xml-commons +1 | 1.3.02-2jpp_1rh | RHSA-2010:0602 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Apache Tomcat User Enumeration
auxiliary/scanner/http/tomcat_enum
Exploit-DB 1
- Apache Tomcat 6.0.18 - Form Authentication Existing/Non-Existing 'Username' Enumeration EDB-33023 · remote · Jun 3, 2009 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | >= 4.1.0, < 4.1.40 | 4.1.40 | GHSA-w227-xcfx-3pj8 |
| Maven | org.apache.tomcat:tomcat | >= 5.0.0, < 5.5.28 | 5.5.28 | GHSA-w227-xcfx-3pj8 |
| Maven | org.apache.tomcat:tomcat | >= 6.0.0, < 6.0.19 | 6.0.19 | GHSA-w227-xcfx-3pj8 |
Advisories 12
- RHSA-2010:0602 Red Hat Security Advisory: Red Hat Certificate System 7.3 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1164 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2207-1 tomcat5.5 - several Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2009:1616 Red Hat Security Advisory: tomcat security update for Red Hat Network Satellite Server Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2009:1563 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2009:1562 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2009:1506 Red Hat Security Advisory: tomcat6 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2009:1454 Red Hat Security Advisory: tomcat5 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2009:1146 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0.CP05 update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2009:1145 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0.CP05 update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2009:1144 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0.CP07 update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2009:1143 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0.CP07 update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- oval:org.mitre.oval:def:9101 vdb-entry signature
- http://tomcat.apache.org/security-4.html
- oval:org.mitre.oval:def:18915 vdb-entry signature
- HPSBMA02535 vendor-advisory
- 35326 third-party-advisory
- MDVSA-2009:138 vendor-advisory
- FEDORA-2009-11356 vendor-advisory
- DSA-2207 vendor-advisory
- 35196 vdb-entry
- 35344 third-party-advisory
- HPSBUX02860 vendor-advisory
- 37460 third-party-advisory
- ADV-2010-3056 vdb-entry
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- 35788 third-party-advisory
- 20090605 [SECURITY] CVE-2009-0580 UPDATED Apache Tomcat User enumeration vulnerability with FORM authentication mailing-list
- http://svn.apache.org/viewvc?rev=747840&view=rev
- 20090603 [SECURITY] CVE-2009-0580 Apache Tomcat User enumeration vulnerability with FORM authentication mailing-list
- APPLE-SA-2010-03-29-1 vendor-advisory
- ADV-2009-1496 vdb-entry
- HPSBOV02762 vendor-advisory
- 20090604 Re: [SECURITY] CVE-2009-0580 Apache Tomcat User enumeration vulnerability with FORM authentication mailing-list
- http://svn.apache.org/viewvc?rev=781382&view=rev
- oval:org.mitre.oval:def:6628 vdb-entry signature
- ADV-2009-1856 vdb-entry
- 1022332 vdb-entry
- MDVSA-2010:176 vendor-advisory
- 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components mailing-list
- 42368 third-party-advisory
- http://tomcat.apache.org/security-6.html
- http://support.apple.com/kb/HT4077
- FEDORA-2009-11374 vendor-advisory
- 35685 third-party-advisory
- FEDORA-2009-11352 vendor-advisory
- http://tomcat.apache.org/security-5.html
- SUSE-SR:2009:012 vendor-advisory
- HPSBUX02579 vendor-advisory
- tomcat-jsecuritycheck-info-disclosure(50930) vdb-entry
- http://svn.apache.org/viewvc?rev=781379&view=rev
- MDVSA-2009:136 vendor-advisory
- 263529 vendor-advisory
- ADV-2009-3316 vdb-entry
- [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/ mailing-list