CVE-2009-2901

Published: Jan 28, 2010Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests.

Affected (51)

Products: Apache: Tomcat

Apache

1 product

Tomcat

Configuration A

51 vulnerable

Vulnerable Software	Affected Versions
Apache Tomcat	Version 5.5.0
Apache Tomcat	Version 5.5.10
Apache Tomcat	Version 5.5.11
Apache Tomcat	Version 5.5.12
Apache Tomcat	Version 5.5.13
Apache Tomcat	Version 5.5.14
Apache Tomcat	Version 5.5.15
Apache Tomcat	Version 5.5.16
Apache Tomcat	Version 5.5.17
Apache Tomcat	Version 5.5.18
Apache Tomcat	Version 5.5.19
Apache Tomcat	Version 5.5.1
Apache Tomcat	Version 5.5.20
Apache Tomcat	Version 5.5.21
Apache Tomcat	Version 5.5.22
Apache Tomcat	Version 5.5.23
Apache Tomcat	Version 5.5.24
Apache Tomcat	Version 5.5.25
Apache Tomcat	Version 5.5.26
Apache Tomcat	Version 5.5.27
Apache Tomcat	Version 5.5.28
Apache Tomcat	Version 5.5.2
Apache Tomcat	Version 5.5.3
Apache Tomcat	Version 5.5.4
Apache Tomcat	Version 5.5.5
Apache Tomcat	Version 5.5.6
Apache Tomcat	Version 5.5.7
Apache Tomcat	Version 5.5.8
Apache Tomcat	Version 5.5.9
Apache Tomcat	Version 6.0.0
Apache Tomcat	Version 6.0.10
Apache Tomcat	Version 6.0.11
Apache Tomcat	Version 6.0.12
Apache Tomcat	Version 6.0.13
Apache Tomcat	Version 6.0.14
Apache Tomcat	Version 6.0.15
Apache Tomcat	Version 6.0.16
Apache Tomcat	Version 6.0.17
Apache Tomcat	Version 6.0.18
Apache Tomcat	Version 6.0.19
Apache Tomcat	Version 6.0.1
Apache Tomcat	Version 6.0.20
Apache Tomcat	Version 6.0.2
Apache Tomcat	Version 6.0.3
Apache Tomcat	Version 6.0.4
Apache Tomcat	Version 6.0.5
Apache Tomcat	Version 6.0.6
Apache Tomcat	Version 6.0.7
Apache Tomcat	Version 6.0.8
Apache Tomcat	Version 6.0.9
Apache Tomcat	Version 6.0

Related CWEs

CWE-264

References (68)

http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=127420533226623&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=133469267822771&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=139344343412337&w=2

Source: secalert@redhat.com

http://secunia.com/advisories/38316

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/38346

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/38541

Source: secalert@redhat.com

http://secunia.com/advisories/39317

Source: secalert@redhat.com

http://secunia.com/advisories/43310

Source: secalert@redhat.com

http://secunia.com/advisories/57126

Source: secalert@redhat.com

http://securitytracker.com/id?1023503

Source: secalert@redhat.com

http://support.apple.com/kb/HT4077

Source: secalert@redhat.com

http://svn.apache.org/viewvc?rev=892815&view=rev

Source: secalert@redhat.com

Patch

http://svn.apache.org/viewvc?rev=902650&view=rev

Source: secalert@redhat.com

Patch

http://tomcat.apache.org/security-5.html

Source: secalert@redhat.com

PatchVendor Advisory

http://tomcat.apache.org/security-6.html

Source: secalert@redhat.com

PatchVendor Advisory

http://ubuntu.com/usn/usn-899-1

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2010:176

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2010:177

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/509151/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/516397/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/37942

Source: secalert@redhat.com

http://www.vmware.com/security/advisories/VMSA-2011-0003.html

Source: secalert@redhat.com

http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2010/0213

Source: secalert@redhat.com

PatchVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/55856

Source: secalert@redhat.com

https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html