{"cve_id":"CVE-2009-0580","published":"2009-06-05T16:00:00.233000+00:00","last_modified":"2026-06-16T23:05:20.887000+00:00","vuln_status":"Modified","description":"Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter.","cvss_version":"2.0","cvss_vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","base_score":4.3,"base_severity":"MEDIUM","attack_vector":"NETWORK","privileges_req":"","user_interaction":"NONE","scope":"","impact_c":"PARTIAL","impact_i":"NONE","impact_a":"NONE","cwe_ids":["CWE-200"],"in_kev":false,"kev_date_added":null,"kev_ransomware":false,"epss_score":0.9444,"epss_percentile":0.99852,"cap_rule_version":"0.1.1","stage":"RECON","req_access":"NONE","req_vector":"NETWORK","req_user_interaction":false,"grant_access":"NONE","caps":["INFO_DISCLOSURE"],"terminal":false,"cap_confidence":"high","ingested_at":"2026-09-18T07:50:40.667264+00:00","first_seen":"2009-06-05T16:00:00.233000+00:00","kev_first_seen":null,"novelty_score":0.0,"novelty_reasons":[],"novelty_at":null,"vendors":["apache"],"products":["tomcat"],"affected":[{"vendor":"apache","product":"tomcat","ranges":["4.1.0","4.1.1","4.1.2","4.1.3","4.1.4","4.1.5","4.1.6","4.1.7","4.1.8","4.1.9","4.1.10","4.1.11","4.1.12","4.1.13","4.1.14","4.1.15","4.1.16","4.1.17","4.1.18","4.1.19","4.1.20","4.1.21","4.1.22","4.1.23","4.1.24","4.1.25","4.1.26","4.1.27","4.1.28","4.1.29","4.1.30","4.1.31","4.1.32","4.1.33","4.1.34","4.1.35","4.1.36","4.1.37","4.1.38","4.1.39","5.5.0","5.5.1","5.5.2","5.5.3","5.5.4","5.5.5","5.5.6","5.5.7","5.5.8","5.5.9","5.5.10","5.5.11","5.5.12","5.5.13","5.5.14","5.5.15","5.5.16","5.5.17","5.5.18","5.5.19","5.5.20","5.5.21","5.5.22","5.5.23","5.5.24","5.5.25","5.5.26","5.5.27","6.0.0","6.0.1","6.0.2","6.0.3","6.0.4","6.0.5","6.0.6","6.0.7","6.0.8","6.0.9","6.0.10","6.0.11","6.0.12","6.0.13","6.0.14","6.0.15","6.0.16"]}]}