NVD

Id
47909  
Name
CVE-2009-0580  
Description
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-07  
Published
2009-06-05  
Modified Date
2016-08-22  
Seq
2009-0580  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
240050 47909 CVE-2009-0580 APPLE-SA-2010-03-29-1  View
240051 47909 CVE-2009-0580 SUSE-SR:2009:012  View
240052 47909 CVE-2009-0580 SSRT100029  View
240053 47909 CVE-2009-0580 SSRT100203  View
240054 47909 CVE-2009-0580 SSRT100825  View
240055 47909 CVE-2009-0580 HPSBUX02860  View
240056 47909 CVE-2009-0580 oval:org.mitre.oval:def:18915  View
240057 47909 CVE-2009-0580 oval:org.mitre.oval:def:6628  View
240058 47909 CVE-2009-0580 oval:org.mitre.oval:def:9101  View
240059 47909 CVE-2009-0580 1022332  View
240060 47909 CVE-2009-0580 263529  View
240061 47909 CVE-2009-0580 http://support.apple.com/kb/HT4077  View
240062 47909 CVE-2009-0580 http://svn.apache.org/viewvc?rev=747840&view=rev  View
240063 47909 CVE-2009-0580 http://svn.apache.org/viewvc?rev=781379&view=rev  View
240064 47909 CVE-2009-0580 http://svn.apache.org/viewvc?rev=781382&view=rev  View
240065 47909 CVE-2009-0580 http://tomcat.apache.org/security-4.html  View
240066 47909 CVE-2009-0580 http://tomcat.apache.org/security-5.html  View
240067 47909 CVE-2009-0580 http://tomcat.apache.org/security-6.html  View
240068 47909 CVE-2009-0580 DSA-2207  View
240069 47909 CVE-2009-0580 MDVSA-2009:136  View
240070 47909 CVE-2009-0580 MDVSA-2009:138  View
240071 47909 CVE-2009-0580 MDVSA-2010:176  View
240072 47909 CVE-2009-0580 20090603 [SECURITY] CVE-2009-0580 Apache Tomcat User enumeration vulnerability with FORM authentication  View
240073 47909 CVE-2009-0580 20090604 Re: [SECURITY] CVE-2009-0580 Apache Tomcat User enumeration vulnerability with FORM authentication  View
240074 47909 CVE-2009-0580 20090605 [SECURITY] CVE-2009-0580 UPDATED Apache Tomcat User enumeration vulnerability with FORM authentication  View
240075 47909 CVE-2009-0580 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components  View
240076 47909 CVE-2009-0580 35196  View
240077 47909 CVE-2009-0580 http://www.vmware.com/security/advisories/VMSA-2009-0016.html  View
240078 47909 CVE-2009-0580 ADV-2009-1496  View
240079 47909 CVE-2009-0580 ADV-2009-1856  View
240080 47909 CVE-2009-0580 ADV-2009-3316  View
240081 47909 CVE-2009-0580 ADV-2010-3056  View
240082 47909 CVE-2009-0580 tomcat-jsecuritycheck-info-disclosure(50930)  View
240083 47909 CVE-2009-0580 FEDORA-2009-11374  View
240084 47909 CVE-2009-0580 FEDORA-2009-11352  View
240085 47909 CVE-2009-0580 FEDORA-2009-11356  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
40730 JVNDB-2009-001736 Apache Tomcat における有効なユーザ名を列挙される脆弱性 Apache Tomcat には、FORM 認証を使用している場合に、エラーチェック処理に不備があるため、有効なユーザ名を列挙される脆弱性が存在します。 CVE-2009-0580 38011 CVE-2009-0580 47909 4.3 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001736.html 2009-06-05 2012-09-28 View