CVE-2009-2901: Improper Authentication in Apache Tomcat
Summary
CVE-2009-2901: Improper Authentication in Apache Tomcat. Affects org.apache.tomcat:tomcat across 2 version ranges.
>= 5.5.0, < 5.5.29
>= 6.0.0, < 6.0.24
Fixed in 5.5.29 or 6.0.24, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications. It provides a Java HTTP web server environment for running Java code. The autodeployment process in Apache Tomcat versions 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy. This vulnerability allows remote attackers to bypass intended authentication requirements via HTTP requests.
Vulnerability Detail
The autodeployment process in Apache Tomcat allows an attacker to bypass authentication requirements by exploiting the deployment of appBase files that were not properly removed during a failed undeploy. By sending HTTP requests, an attacker can gain unauthorized access to the application without providing the required authentication credentials. This vulnerability poses a moderate risk as it can lead to unauthorized access to sensitive information or unauthorized actions within the application.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 5.5.0, < 5.5.295.5.29 -
>= 6.0.0, < 6.0.246.0.24
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
A possible workaround for this vulnerability is to manually remove the appBase files after a failed undeploy. This can be done by accessing the file system and deleting the corresponding files. However, this workaround is not recommended as it requires manual intervention and may not be feasible in all scenarios.
Conclusion
The vulnerability in Apache Tomcat allows attackers to bypass authentication requirements and gain unauthorized access to the application. It is crucial to upgrade to a fixed version of Apache Tomcat and disable the autoDeploy feature if it is not necessary. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications.
The autodeployment process in Apache Tomcat automatically deploys web applications by monitoring the appBase directory for changes.
This vulnerability allows an attacker to bypass authentication by exploiting the deployment of appBase files that were not properly removed during a failed undeploy.
The potential consequences of this vulnerability include unauthorized access to sensitive information or unauthorized actions within the application.
To fix this vulnerability, it is recommended to upgrade to a fixed version of Apache Tomcat and disable the autoDeploy feature if it is not required.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
