AUGUST 4, 2026
Live Feed
Back to database
Case File

CVE-2009-0580

MEDIUM · CVSS 4.3 EPSS 94.44%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2009-06-05 · Last synced 2026-08-04

CyberRota Analysis

AI analysis pending.

CVE
CVE-2009-0580
Severity
MEDIUM
CVSS
4.3
EPSS
94.44%
Apache

Original NVD Description

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter.