PT-2010-2314 · Apache+1 · Tomcat Manager+1

Published 2010-02-05 · Updated 2010-02-08 · CVE-2010-0557

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IBM Cognos Express version 9.0

Description The issue allows attackers to obtain unspecified access to the Tomcat Manager component and cause a denial of service by leveraging hardcoded credentials.

Recommendations For IBM Cognos Express version 9.0, update the credentials to prevent hardcoded access, and ensure proper configuration to avoid denial of service attacks.

Exploit

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2010-0557

Affected Products

Ibm Cognos Express

Tomcat Manager

References · 10

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/tomcat_mgr_login.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_mgr_deploy.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_mgr_upload.rb · Exploit
• 🔥 https://exploit-db.com/exploits/16317 · Exploit
• http://www-01.ibm.com/support/docview.wss?uid=swg21419179 · Vendor Advisory
• http://secunia.com/advisories/38457 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-0557 · Security Note
• http://vupen.com/english/advisories/2010/0297 · Vendor Advisory
• http://osvdb.org/62118 · Note
• http://securityfocus.com/bid/38084 · Note