CVE-2009-2901
Improper Authentication in Apache Tomcat
The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests.
Exploit likelihood
What each source reports
NVD Score used
The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests.
- Record
CVE-2009-2901- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests.
- Record
CVE-2009-2901- Updated
- 2026-11-02
EUVDEUVD-2022-4169 No score
The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests.
- Record
EUVD-2022-4169- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hjfh-7c4v-7q8h No score
Improper Authentication in Apache Tomcat
The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests.
- Record
GHSA-hjfh-7c4v-7q8h- Weakness
- CWE-287
- Updated
- 2026-11-02
OSVGHSA-hjfh-7c4v-7q8h No score
Improper Authentication in Apache Tomcat
The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests.
- Record
GHSA-hjfh-7c4v-7q8h- Weakness
- CWE-287
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.tomcat:tomcatMaven |
5.5.0 to 5.5.28 | 5.5.29 |
org.apache.tomcat:tomcatMaven |
6.0.0 up to 6.0.24 | 6.0.24 |
org.apache.tomcat:tomcatMaven |
5.5.0 up to 5.5.29 | 5.5.29 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-2901 is a medium vulnerability (CVSS 4.3) in Apache Tomcat, published January 28, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.12%, the 94th percentile. Fixed in org.apache.tomcat:tomcat 5.5.29.
References
securityfocus.com/bid/37942
marc.info?l=bugtraq&m=127420533226623&w=2
svn.apache.org/viewvc?rev=892815&view=rev
secunia.com/advisories/39317
lists.opensuse.org/opensuse-updates/2012-12/msg00089.html
Show 37 moreShow less
mandriva.com/security/advisories?name=MDVSA-2010:177
securitytracker.com/id?1023503
lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
tomcat.apache.org/security-6.html
vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html
ubuntu.com/usn/usn-899-1
support.apple.com/kb/HT4077
exchange.xforce.ibmcloud.com/vulnerabilities/55856
vupen.com/english/advisories/2010/0213
lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2009-2901
github.com/apache/tomcat/commit/3e1010b1a2f648581fac3d68afbf18f2979f6bf6