GHSA-w227-xcfx-3pj8 · Severity: medium · Ecosystem: maven — Exposure of Sensitive Information in Apache Tomcat
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter.
Conclusion & alert: CVE-2009-0580 is rated High Exploit Risk (72/100): CVSS Medium severity, with high exploitation likelihood (EPSS 94.44%, 100th percentile). Core evidence: 1 public exploit reference(s) are indexed (Exploit-DB). EPSS rose +4.87% over the last day, indicating growing attacker interest. Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
| EDB-ID | Source | Kind | Published | Link |
|---|---|---|---|---|
| 33023 | exploit_db | edb | 2009-06-03 | Exploit-DB ↗ |
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 89.57% | 94.44% | +4.87% |
| 2 | 2026-06-07 | 88.17% | 89.57% | +1.40% |
| 3 | 2026-03-04 | — | 88.17% | — |
Full EPSS history (52 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 4.3 | 2.0 | MEDIUM |
|
8.6 | 2.9 | [email protected] |
GHSA-w227-xcfx-3pj8 · Severity: medium · Ecosystem: maven — Exposure of Sensitive Information in Apache Tomcat
| vendor | priority | summary | link |
|---|---|---|---|
gentoo
|
normal | CVE-2009-0580: 1 GLSA(s) (201206-24), 1 atom(s) (www-servers/tomcat); latest impact normal. | https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2009-0580 |
redhat
|
low | — | https://access.redhat.com/security/cve/CVE-2009-0580 |
ubuntu
|
low | CVE-2009-0580 low priority: Ubuntu including 3 source packages (tomcat5, tomcat5.5, tomcat6), 30 status rows across 10 suites (dapper, hardy, intrepid, jaunty, karmic, lucid, maverick, natty, oneiric, upstream): DNE 16, not-affected 5, ignored 4, released 3, needs-triage 2. | https://ubuntu.com/security/CVE-2009-0580 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| apache | tomcat | 4.1.0 | cpe:2.3:a:apache:tomcat:4.1.0:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.1 | cpe:2.3:a:apache:tomcat:4.1.1:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.2 | cpe:2.3:a:apache:tomcat:4.1.2:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.3 | cpe:2.3:a:apache:tomcat:4.1.3:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.3 | cpe:2.3:a:apache:tomcat:4.1.3:beta:*:*:*:*:*:* |
| apache | tomcat | 4.1.4 | cpe:2.3:a:apache:tomcat:4.1.4:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.5 | cpe:2.3:a:apache:tomcat:4.1.5:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.6 | cpe:2.3:a:apache:tomcat:4.1.6:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.7 | cpe:2.3:a:apache:tomcat:4.1.7:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.8 | cpe:2.3:a:apache:tomcat:4.1.8:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.9 | cpe:2.3:a:apache:tomcat:4.1.9:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.9 | cpe:2.3:a:apache:tomcat:4.1.9:beta:*:*:*:*:*:* |
| apache | tomcat | 4.1.10 | cpe:2.3:a:apache:tomcat:4.1.10:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.11 | cpe:2.3:a:apache:tomcat:4.1.11:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.12 | cpe:2.3:a:apache:tomcat:4.1.12:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.13 | cpe:2.3:a:apache:tomcat:4.1.13:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.14 | cpe:2.3:a:apache:tomcat:4.1.14:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.15 | cpe:2.3:a:apache:tomcat:4.1.15:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.16 | cpe:2.3:a:apache:tomcat:4.1.16:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.17 | cpe:2.3:a:apache:tomcat:4.1.17:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.18 | cpe:2.3:a:apache:tomcat:4.1.18:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.19 | cpe:2.3:a:apache:tomcat:4.1.19:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.20 | cpe:2.3:a:apache:tomcat:4.1.20:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.21 | cpe:2.3:a:apache:tomcat:4.1.21:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.22 | cpe:2.3:a:apache:tomcat:4.1.22:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.23 | cpe:2.3:a:apache:tomcat:4.1.23:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.24 | cpe:2.3:a:apache:tomcat:4.1.24:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.25 | cpe:2.3:a:apache:tomcat:4.1.25:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.26 | cpe:2.3:a:apache:tomcat:4.1.26:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.27 | cpe:2.3:a:apache:tomcat:4.1.27:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.28 | cpe:2.3:a:apache:tomcat:4.1.28:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.29 | cpe:2.3:a:apache:tomcat:4.1.29:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.30 | cpe:2.3:a:apache:tomcat:4.1.30:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.31 | cpe:2.3:a:apache:tomcat:4.1.31:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.32 | cpe:2.3:a:apache:tomcat:4.1.32:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.33 | cpe:2.3:a:apache:tomcat:4.1.33:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.34 | cpe:2.3:a:apache:tomcat:4.1.34:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.35 | cpe:2.3:a:apache:tomcat:4.1.35:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.36 | cpe:2.3:a:apache:tomcat:4.1.36:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.37 | cpe:2.3:a:apache:tomcat:4.1.37:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.38 | cpe:2.3:a:apache:tomcat:4.1.38:*:*:*:*:*:*:* |
| apache | tomcat | 4.1.39 | cpe:2.3:a:apache:tomcat:4.1.39:*:*:*:*:*:*:* |
| apache | tomcat | 5.5.0 | cpe:2.3:a:apache:tomcat:5.5.0:*:*:*:*:*:*:* |
| apache | tomcat | 5.5.1 | cpe:2.3:a:apache:tomcat:5.5.1:*:*:*:*:*:*:* |
| apache | tomcat | 5.5.2 | cpe:2.3:a:apache:tomcat:5.5.2:*:*:*:*:*:*:* |
| apache | tomcat | 5.5.3 | cpe:2.3:a:apache:tomcat:5.5.3:*:*:*:*:*:*:* |
| apache | tomcat | 5.5.4 | cpe:2.3:a:apache:tomcat:5.5.4:*:*:*:*:*:*:* |
| apache | tomcat | 5.5.5 | cpe:2.3:a:apache:tomcat:5.5.5:*:*:*:*:*:*:* |
| apache | tomcat | 5.5.6 | cpe:2.3:a:apache:tomcat:5.5.6:*:*:*:*:*:*:* |
| apache | tomcat | 5.5.7 | cpe:2.3:a:apache:tomcat:5.5.7:*:*:*:*:*:*:* |
| apache | tomcat | 5.5.8 | cpe:2.3:a:apache:tomcat:5.5.8:*:*:*:*:*:*:* |
| apache | tomcat | 5.5.9 | cpe:2.3:a:apache:tomcat:5.5.9:*:*:*:*:*:*:* |
| apache | tomcat | 5.5.10 | cpe:2.3:a:apache:tomcat:5.5.10:*:*:*:*:*:*:* |
| apache | tomcat | 5.5.11 | cpe:2.3:a:apache:tomcat:5.5.11:*:*:*:*:*:*:* |
| apache | tomcat | 5.5.12 | cpe:2.3:a:apache:tomcat:5.5.12:*:*:*:*:*:*:* |
| apache | tomcat | 5.5.13 | cpe:2.3:a:apache:tomcat:5.5.13:*:*:*:*:*:*:* |
| apache | tomcat | 5.5.14 | cpe:2.3:a:apache:tomcat:5.5.14:*:*:*:*:*:*:* |
| apache | tomcat | 5.5.15 | cpe:2.3:a:apache:tomcat:5.5.15:*:*:*:*:*:*:* |
| apache | tomcat | 5.5.16 | cpe:2.3:a:apache:tomcat:5.5.16:*:*:*:*:*:*:* |
| apache | tomcat | 5.5.17 | cpe:2.3:a:apache:tomcat:5.5.17:*:*:*:*:*:*:* |
| apache | tomcat | 5.5.18 | cpe:2.3:a:apache:tomcat:5.5.18:*:*:*:*:*:*:* |
| apache | tomcat | 5.5.19 | cpe:2.3:a:apache:tomcat:5.5.19:*:*:*:*:*:*:* |
| apache | tomcat | 5.5.20 | cpe:2.3:a:apache:tomcat:5.5.20:*:*:*:*:*:*:* |
| apache | tomcat | 5.5.21 | cpe:2.3:a:apache:tomcat:5.5.21:*:*:*:*:*:*:* |
| apache | tomcat | 5.5.22 | cpe:2.3:a:apache:tomcat:5.5.22:*:*:*:*:*:*:* |
| apache | tomcat | 5.5.23 | cpe:2.3:a:apache:tomcat:5.5.23:*:*:*:*:*:*:* |
| apache | tomcat | 5.5.24 | cpe:2.3:a:apache:tomcat:5.5.24:*:*:*:*:*:*:* |
| apache | tomcat | 5.5.25 | cpe:2.3:a:apache:tomcat:5.5.25:*:*:*:*:*:*:* |
| apache | tomcat | 5.5.26 | cpe:2.3:a:apache:tomcat:5.5.26:*:*:*:*:*:*:* |
| apache | tomcat | 5.5.27 | cpe:2.3:a:apache:tomcat:5.5.27:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.0 | cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.1 | cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.2 | cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.3 | cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.4 | cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.5 | cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.6 | cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.7 | cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.8 | cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:* |
| apache | tomcat | 6.0.9 | cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:* |