Read the docs
TI-2009-03385 Aliases CVE-2009-3548GHSA-975h-h4pp-737q

The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and…

Priority HIGH 73CWE-255Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.

Why it matters now

EPSS 0.78995 99th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 142

CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:3.0:*:*:*:*:*:*:*3.0VulnerableApache
cpe:2.3:a:apache:tomcat:3.1:*:*:*:*:*:*:*3.1VulnerableApache
cpe:2.3:a:apache:tomcat:3.1.1:*:*:*:*:*:*:*3.1.1VulnerableApache
cpe:2.3:a:apache:tomcat:3.2:*:*:*:*:*:*:*3.2VulnerableApache
cpe:2.3:a:apache:tomcat:3.2.1:*:*:*:*:*:*:*3.2.1VulnerableApache
cpe:2.3:a:apache:tomcat:3.2.2:*:*:*:*:*:*:*3.2.2VulnerableApache
cpe:2.3:a:apache:tomcat:3.2.2:beta2:*:*:*:*:*:*3.2.2 beta2VulnerableApache
cpe:2.3:a:apache:tomcat:3.2.3:*:*:*:*:*:*:*3.2.3VulnerableApache
cpe:2.3:a:apache:tomcat:3.2.4:*:*:*:*:*:*:*3.2.4VulnerableApache
cpe:2.3:a:apache:tomcat:3.3:*:*:*:*:*:*:*3.3VulnerableApache
  • cpe:2.3:a:apache:tomcat:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:3.1:*:*:*:*:*:*:* Versions 3.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:3.1.1:*:*:*:*:*:*:* Versions 3.1.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:3.2:*:*:*:*:*:*:* Versions 3.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:3.2.1:*:*:*:*:*:*:* Versions 3.2.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:3.2.2:*:*:*:*:*:*:* Versions 3.2.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:3.2.2:beta2:*:*:*:*:*:* Versions 3.2.2 beta2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:3.2.3:*:*:*:*:*:*:* Versions 3.2.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:3.2.4:*:*:*:*:*:*:* Versions 3.2.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:3.3:*:*:*:*:*:*:* Versions 3.3 Vulnerable ·Apache
Show 132 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:3.3.1:*:*:*:*:*:*:*3.3.1VulnerableApache
cpe:2.3:a:apache:tomcat:3.3.1a:*:*:*:*:*:*:*3.3.1aVulnerableApache
cpe:2.3:a:apache:tomcat:3.3.2:*:*:*:*:*:*:*3.3.2VulnerableApache
cpe:2.3:a:apache:tomcat:4.0.0:*:*:*:*:*:*:*4.0.0VulnerableApache
cpe:2.3:a:apache:tomcat:4.0.1:*:*:*:*:*:*:*4.0.1VulnerableApache
cpe:2.3:a:apache:tomcat:4.0.2:*:*:*:*:*:*:*4.0.2VulnerableApache
cpe:2.3:a:apache:tomcat:4.0.3:*:*:*:*:*:*:*4.0.3VulnerableApache
cpe:2.3:a:apache:tomcat:4.0.4:*:*:*:*:*:*:*4.0.4VulnerableApache
cpe:2.3:a:apache:tomcat:4.0.5:*:*:*:*:*:*:*4.0.5VulnerableApache
cpe:2.3:a:apache:tomcat:4.0.6:*:*:*:*:*:*:*4.0.6VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.0:*:*:*:*:*:*:*4.1.0VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.1:*:*:*:*:*:*:*4.1.1VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.2:*:*:*:*:*:*:*4.1.2VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.3:*:*:*:*:*:*:*4.1.3VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.3:beta:*:*:*:*:*:*4.1.3 betaVulnerableApache
cpe:2.3:a:apache:tomcat:4.1.4:*:*:*:*:*:*:*4.1.4VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.5:*:*:*:*:*:*:*4.1.5VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.6:*:*:*:*:*:*:*4.1.6VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.7:*:*:*:*:*:*:*4.1.7VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.8:*:*:*:*:*:*:*4.1.8VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.9:*:*:*:*:*:*:*4.1.9VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.9:beta:*:*:*:*:*:*4.1.9 betaVulnerableApache
cpe:2.3:a:apache:tomcat:4.1.10:*:*:*:*:*:*:*4.1.10VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.11:*:*:*:*:*:*:*4.1.11VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.12:*:*:*:*:*:*:*4.1.12VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.13:*:*:*:*:*:*:*4.1.13VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.14:*:*:*:*:*:*:*4.1.14VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.15:*:*:*:*:*:*:*4.1.15VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.16:*:*:*:*:*:*:*4.1.16VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.17:*:*:*:*:*:*:*4.1.17VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.18:*:*:*:*:*:*:*4.1.18VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.19:*:*:*:*:*:*:*4.1.19VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.20:*:*:*:*:*:*:*4.1.20VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.21:*:*:*:*:*:*:*4.1.21VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.22:*:*:*:*:*:*:*4.1.22VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.23:*:*:*:*:*:*:*4.1.23VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.24:*:*:*:*:*:*:*4.1.24VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.25:*:*:*:*:*:*:*4.1.25VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.26:*:*:*:*:*:*:*4.1.26VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.27:*:*:*:*:*:*:*4.1.27VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.28:*:*:*:*:*:*:*4.1.28VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.29:*:*:*:*:*:*:*4.1.29VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.30:*:*:*:*:*:*:*4.1.30VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.31:*:*:*:*:*:*:*4.1.31VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.32:*:*:*:*:*:*:*4.1.32VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.33:*:*:*:*:*:*:*4.1.33VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.34:*:*:*:*:*:*:*4.1.34VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.35:*:*:*:*:*:*:*4.1.35VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.36:*:*:*:*:*:*:*4.1.36VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.37:*:*:*:*:*:*:*4.1.37VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.38:*:*:*:*:*:*:*4.1.38VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.39:*:*:*:*:*:*:*4.1.39VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.0:*:*:*:*:*:*:*5.0.0VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.1:*:*:*:*:*:*:*5.0.1VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.2:*:*:*:*:*:*:*5.0.2VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.3:*:*:*:*:*:*:*5.0.3VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.4:*:*:*:*:*:*:*5.0.4VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.5:*:*:*:*:*:*:*5.0.5VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.6:*:*:*:*:*:*:*5.0.6VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.7:*:*:*:*:*:*:*5.0.7VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.8:*:*:*:*:*:*:*5.0.8VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.9:*:*:*:*:*:*:*5.0.9VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.10:*:*:*:*:*:*:*5.0.10VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.11:*:*:*:*:*:*:*5.0.11VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.12:*:*:*:*:*:*:*5.0.12VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.13:*:*:*:*:*:*:*5.0.13VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.14:*:*:*:*:*:*:*5.0.14VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.15:*:*:*:*:*:*:*5.0.15VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.16:*:*:*:*:*:*:*5.0.16VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.17:*:*:*:*:*:*:*5.0.17VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.18:*:*:*:*:*:*:*5.0.18VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.19:*:*:*:*:*:*:*5.0.19VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.21:*:*:*:*:*:*:*5.0.21VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.22:*:*:*:*:*:*:*5.0.22VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.23:*:*:*:*:*:*:*5.0.23VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.24:*:*:*:*:*:*:*5.0.24VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.25:*:*:*:*:*:*:*5.0.25VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.26:*:*:*:*:*:*:*5.0.26VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.27:*:*:*:*:*:*:*5.0.27VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.28:*:*:*:*:*:*:*5.0.28VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.29:*:*:*:*:*:*:*5.0.29VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.30:*:*:*:*:*:*:*5.0.30VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.0:*:*:*:*:*:*:*5.5.0VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.1:*:*:*:*:*:*:*5.5.1VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.2:*:*:*:*:*:*:*5.5.2VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.3:*:*:*:*:*:*:*5.5.3VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.4:*:*:*:*:*:*:*5.5.4VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.5:*:*:*:*:*:*:*5.5.5VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.6:*:*:*:*:*:*:*5.5.6VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.7:*:*:*:*:*:*:*5.5.7VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.8:*:*:*:*:*:*:*5.5.8VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.9:*:*:*:*:*:*:*5.5.9VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.10:*:*:*:*:*:*:*5.5.10VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.11:*:*:*:*:*:*:*5.5.11VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.12:*:*:*:*:*:*:*5.5.12VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.13:*:*:*:*:*:*:*5.5.13VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.14:*:*:*:*:*:*:*5.5.14VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.15:*:*:*:*:*:*:*5.5.15VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.16:*:*:*:*:*:*:*5.5.16VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.17:*:*:*:*:*:*:*5.5.17VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.18:*:*:*:*:*:*:*5.5.18VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.19:*:*:*:*:*:*:*5.5.19VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.20:*:*:*:*:*:*:*5.5.20VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.21:*:*:*:*:*:*:*5.5.21VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.22:*:*:*:*:*:*:*5.5.22VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.23:*:*:*:*:*:*:*5.5.23VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.24:*:*:*:*:*:*:*5.5.24VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.25:*:*:*:*:*:*:*5.5.25VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.26:*:*:*:*:*:*:*5.5.26VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.27:*:*:*:*:*:*:*5.5.27VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.28:*:*:*:*:*:*:*5.5.28VulnerableApache
cpe:2.3:a:apache:tomcat:6.0:*:*:*:*:*:*:*6.0VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:*6.0.0VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:*6.0.1VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:*6.0.2VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:*6.0.3VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:*6.0.4VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:*6.0.5VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:*6.0.6VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:*6.0.7VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:*6.0.8VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:*6.0.9VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:*6.0.10VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:*6.0.11VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:*6.0.12VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:*6.0.13VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:*6.0.14VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:*6.0.15VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:*6.0.16VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.17:*:*:*:*:*:*:*6.0.17VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.18:*:*:*:*:*:*:*6.0.18VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.20:*:*:*:*:*:*:*6.0.20VulnerableApache
  • cpe:2.3:a:apache:tomcat:3.3.1:*:*:*:*:*:*:* Versions 3.3.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:3.3.1a:*:*:*:*:*:*:* Versions 3.3.1a Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:3.3.2:*:*:*:*:*:*:* Versions 3.3.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.0.0:*:*:*:*:*:*:* Versions 4.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.0.1:*:*:*:*:*:*:* Versions 4.0.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.0.2:*:*:*:*:*:*:* Versions 4.0.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.0.3:*:*:*:*:*:*:* Versions 4.0.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.0.4:*:*:*:*:*:*:* Versions 4.0.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.0.5:*:*:*:*:*:*:* Versions 4.0.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.0.6:*:*:*:*:*:*:* Versions 4.0.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.0:*:*:*:*:*:*:* Versions 4.1.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.1:*:*:*:*:*:*:* Versions 4.1.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.2:*:*:*:*:*:*:* Versions 4.1.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.3:*:*:*:*:*:*:* Versions 4.1.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.3:beta:*:*:*:*:*:* Versions 4.1.3 beta Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.4:*:*:*:*:*:*:* Versions 4.1.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.5:*:*:*:*:*:*:* Versions 4.1.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.6:*:*:*:*:*:*:* Versions 4.1.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.7:*:*:*:*:*:*:* Versions 4.1.7 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.8:*:*:*:*:*:*:* Versions 4.1.8 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.9:*:*:*:*:*:*:* Versions 4.1.9 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.9:beta:*:*:*:*:*:* Versions 4.1.9 beta Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.10:*:*:*:*:*:*:* Versions 4.1.10 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.11:*:*:*:*:*:*:* Versions 4.1.11 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.12:*:*:*:*:*:*:* Versions 4.1.12 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.13:*:*:*:*:*:*:* Versions 4.1.13 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.14:*:*:*:*:*:*:* Versions 4.1.14 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.15:*:*:*:*:*:*:* Versions 4.1.15 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.16:*:*:*:*:*:*:* Versions 4.1.16 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.17:*:*:*:*:*:*:* Versions 4.1.17 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.18:*:*:*:*:*:*:* Versions 4.1.18 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.19:*:*:*:*:*:*:* Versions 4.1.19 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.20:*:*:*:*:*:*:* Versions 4.1.20 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.21:*:*:*:*:*:*:* Versions 4.1.21 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.22:*:*:*:*:*:*:* Versions 4.1.22 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.23:*:*:*:*:*:*:* Versions 4.1.23 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.24:*:*:*:*:*:*:* Versions 4.1.24 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.25:*:*:*:*:*:*:* Versions 4.1.25 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.26:*:*:*:*:*:*:* Versions 4.1.26 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.27:*:*:*:*:*:*:* Versions 4.1.27 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.28:*:*:*:*:*:*:* Versions 4.1.28 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.29:*:*:*:*:*:*:* Versions 4.1.29 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.30:*:*:*:*:*:*:* Versions 4.1.30 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.31:*:*:*:*:*:*:* Versions 4.1.31 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.32:*:*:*:*:*:*:* Versions 4.1.32 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.33:*:*:*:*:*:*:* Versions 4.1.33 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.34:*:*:*:*:*:*:* Versions 4.1.34 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.35:*:*:*:*:*:*:* Versions 4.1.35 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.36:*:*:*:*:*:*:* Versions 4.1.36 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.37:*:*:*:*:*:*:* Versions 4.1.37 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.38:*:*:*:*:*:*:* Versions 4.1.38 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.39:*:*:*:*:*:*:* Versions 4.1.39 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.0:*:*:*:*:*:*:* Versions 5.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.1:*:*:*:*:*:*:* Versions 5.0.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.2:*:*:*:*:*:*:* Versions 5.0.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.3:*:*:*:*:*:*:* Versions 5.0.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.4:*:*:*:*:*:*:* Versions 5.0.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.5:*:*:*:*:*:*:* Versions 5.0.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.6:*:*:*:*:*:*:* Versions 5.0.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.7:*:*:*:*:*:*:* Versions 5.0.7 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.8:*:*:*:*:*:*:* Versions 5.0.8 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.9:*:*:*:*:*:*:* Versions 5.0.9 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.10:*:*:*:*:*:*:* Versions 5.0.10 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.11:*:*:*:*:*:*:* Versions 5.0.11 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.12:*:*:*:*:*:*:* Versions 5.0.12 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.13:*:*:*:*:*:*:* Versions 5.0.13 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.14:*:*:*:*:*:*:* Versions 5.0.14 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.15:*:*:*:*:*:*:* Versions 5.0.15 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.16:*:*:*:*:*:*:* Versions 5.0.16 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.17:*:*:*:*:*:*:* Versions 5.0.17 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.18:*:*:*:*:*:*:* Versions 5.0.18 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.19:*:*:*:*:*:*:* Versions 5.0.19 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.21:*:*:*:*:*:*:* Versions 5.0.21 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.22:*:*:*:*:*:*:* Versions 5.0.22 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.23:*:*:*:*:*:*:* Versions 5.0.23 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.24:*:*:*:*:*:*:* Versions 5.0.24 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.25:*:*:*:*:*:*:* Versions 5.0.25 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.26:*:*:*:*:*:*:* Versions 5.0.26 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.27:*:*:*:*:*:*:* Versions 5.0.27 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.28:*:*:*:*:*:*:* Versions 5.0.28 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.29:*:*:*:*:*:*:* Versions 5.0.29 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.30:*:*:*:*:*:*:* Versions 5.0.30 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.0:*:*:*:*:*:*:* Versions 5.5.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.1:*:*:*:*:*:*:* Versions 5.5.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.2:*:*:*:*:*:*:* Versions 5.5.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.3:*:*:*:*:*:*:* Versions 5.5.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.4:*:*:*:*:*:*:* Versions 5.5.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.5:*:*:*:*:*:*:* Versions 5.5.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.6:*:*:*:*:*:*:* Versions 5.5.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.7:*:*:*:*:*:*:* Versions 5.5.7 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.8:*:*:*:*:*:*:* Versions 5.5.8 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.9:*:*:*:*:*:*:* Versions 5.5.9 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.10:*:*:*:*:*:*:* Versions 5.5.10 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.11:*:*:*:*:*:*:* Versions 5.5.11 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.12:*:*:*:*:*:*:* Versions 5.5.12 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.13:*:*:*:*:*:*:* Versions 5.5.13 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.14:*:*:*:*:*:*:* Versions 5.5.14 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.15:*:*:*:*:*:*:* Versions 5.5.15 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.16:*:*:*:*:*:*:* Versions 5.5.16 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.17:*:*:*:*:*:*:* Versions 5.5.17 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.18:*:*:*:*:*:*:* Versions 5.5.18 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.19:*:*:*:*:*:*:* Versions 5.5.19 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.20:*:*:*:*:*:*:* Versions 5.5.20 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.21:*:*:*:*:*:*:* Versions 5.5.21 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.22:*:*:*:*:*:*:* Versions 5.5.22 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.23:*:*:*:*:*:*:* Versions 5.5.23 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.24:*:*:*:*:*:*:* Versions 5.5.24 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.25:*:*:*:*:*:*:* Versions 5.5.25 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.26:*:*:*:*:*:*:* Versions 5.5.26 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.27:*:*:*:*:*:*:* Versions 5.5.27 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.28:*:*:*:*:*:*:* Versions 5.5.28 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:* Versions 6.0.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:* Versions 6.0.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:* Versions 6.0.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:* Versions 6.0.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:* Versions 6.0.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:* Versions 6.0.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:* Versions 6.0.7 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:* Versions 6.0.8 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:* Versions 6.0.9 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:* Versions 6.0.10 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:* Versions 6.0.11 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:* Versions 6.0.12 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:* Versions 6.0.13 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:* Versions 6.0.14 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:* Versions 6.0.15 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:* Versions 6.0.16 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.17:*:*:*:*:*:*:* Versions 6.0.17 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.18:*:*:*:*:*:*:* Versions 6.0.18 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.20:*:*:*:*:*:*:* Versions 6.0.20 Vulnerable ·Apache

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-3548
  2. 2026-10-03 Alias added: GHSA-975h-h4pp-737q

References

Patch 2

Advisory 6

Other 11

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
See all 273 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences