Loading HuntDB...

Access to tomcat-manager with default creds

High
J
JetBlue
Submitted None
Reported by doosec101

Vulnerability Details

Technical details and impact analysis

Improper Authentication - Generic
## Summary: Hi jetblue Security Team. I Found that this domain `█████████` using Apache Tomcat/6.0.35 , And i was able to login to https://██████████/manager/html With default credentials `tomcat:tomcat` See the following Screenshots:- ██████████ ███ ## Steps To Reproduce: 1. Go To https://███████/manager/html 2. Login with default creds `tomcat:tomcat` ## Supporting Material/References: - https://book.hacktricks.xyz/pentesting/pentesting-web/tomcat ## Impact Improper Authentication Default Credentials lead to access admin manager. ##Fix:- - Change default creds.

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Improper Authentication - Generic