---
title: "WEB-TOM-001 Tomcat Manager Reachable Without Address Restriction"
canonical: https://openvapt.com/checks/WEB-TOM-001.html
html: https://openvapt.com/checks/WEB-TOM-001.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# WEB-TOM-001 Tomcat Manager Reachable Without Address Restriction

Checks whether the Tomcat Manager or Host Manager application is deployed without an address filter limiting it to localhost.

- Domain: Web Apps
- Severity: High
- Control category: Web Application Security
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`
- CIS Controls v8: 16.7
- NIST CSF 2.0: PR.PS-01
- CWE: CWE-1188, CWE-923
- OWASP Top 10 2021: A01:2021, A05:2021
- OWASP WSTG v4.2: WSTG-CONF-05
- NIST SP 800-53 Rev. 5: AC-3, CM-7

## Why It Matters

The Manager deploys WAR files, which means it runs any code it is given. Exposed to the network it is one stolen or guessed password away from full compromise, and it is a standard target of automated attacks.

## How It Detects

Looks for the manager and host-manager applications in each Tomcat installation's webapps folder (and /usr/share/tomcatN-admin on Debian and Ubuntu), then reads their META-INF/context.xml and conf/Catalina/localhost/<app>.xml. Fails when no active RemoteAddrValve or RemoteCIDRValve restricts access.

## How to Fix

If you do not use them, delete the manager and host-manager folders (or apt remove tomcatN-admin). Otherwise keep the default valve in META-INF/context.xml: <Valve className="org.apache.catalina.valves.RemoteAddrValve" allow="127\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1" /> and reach the Manager through an SSH tunnel.

## How to Verify

```
grep -A2 RemoteAddrValve <webapps>/manager/META-INF/context.xml
```

## Learn the Theory

- [P13 Application Servers: Tomcat, Node.js and Python](https://openvapt.com/academy/p13.md)

## References

- [Apache Tomcat 10.1, Security Considerations](https://tomcat.apache.org/tomcat-10.1-doc/security-howto.html)
- [Apache Tomcat 10.1, Manager App How-To](https://tomcat.apache.org/tomcat-10.1-doc/manager-howto.html)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/tomcat.go

Run it: `openvapt scan --only WEB-TOM-001`. Read it offline: `openvapt explain WEB-TOM-001`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/WEB-TOM-001.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.