CVE-2009-3548
HighPublic exploitThe Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.
Published Nov 12, 2009 · Updated Apr 22, 2026
Key Facts
Patch immediately- CVE-2009-3548 is a high-severity vulnerability (CVSS 7.5 v2) affecting Tomcat (Apache).
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 79% probability of exploitation in the next 30 days.
- No fixed version is listed yet; check the vendor advisory for mitigations.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v2
7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS (30-day exploit likelihood)
79%
Higher than 99.5% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2009-3548 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.
Affected Products
142 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| TomcatApache | 3.0, 3.1, 3.1.1, 3.2, 3.2.1, 3.2.2, 3.2.2-beta2, 3.2.3 | n/a |
Timeline
Publicly disclosed
Nov 12, 2009
Last updated
Apr 22, 2026
Weakness Type
- CWE-255
References
- advisoryADV-2009-3185
- patchhttp://tomcat.apache.org/security-5.html
- patchhttp://tomcat.apache.org/security-6.html
- exploitMSF tomcat_mgr_deploy.rb
- exploitMSF tomcat_mgr_upload.rb
FAQ
Common Questions.
The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.
Affected: Tomcat (Apache) versions 3.0, 3.1, 3.1.1, 3.2, 3.2.1, 3.2.2, 3.2.2-beta2, 3.2.3. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
No fixed version is listed yet; check the vendor advisory for mitigations.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2009-3548 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo