Access to tomcat-manager with default creds

Disclosed: 2023-02-05 12:59:44 By doosec101 To jetblue
High
Vulnerability Details
## Summary: Hi jetblue Security Team. I Found that this domain `█████████` using Apache Tomcat/6.0.35 , And i was able to login to https://██████████/manager/html With default credentials `tomcat:tomcat` See the following Screenshots:- ██████████ ███ ## Steps To Reproduce: 1. Go To https://███████/manager/html 2. Login with default creds `tomcat:tomcat` ## Supporting Material/References: - https://book.hacktricks.xyz/pentesting/pentesting-web/tomcat ## Impact Improper Authentication Default Credentials lead to access admin manager. ##Fix:- - Change default creds.
Actions
View on HackerOne
Report Stats
  • Report ID: 1267174
  • State: Closed
  • Substate: resolved
  • Upvotes: 17
Share this report