CVE-2018-11784
When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.
- CVSS 3.0
- 4.3
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - EPSS
- 98% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-25)
- CWE
- CWE-601
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:tomcat
- canonical:ubuntu_linux
- debian:debian_linux
- netapp:snap_creator_framework
- oracle:communications_application_session_controller
- oracle:hospitality_guest_access
- oracle:instantis_enterprisetrack
- oracle:retail_order_broker
- oracle:secure_global_desktop
- redhat:enterprise_linux_desktop
- redhat:enterprise_linux_server
- redhat:enterprise_linux_server_aus
- redhat:enterprise_linux_server_eus
- redhat:enterprise_linux_server_tus
- redhat:enterprise_linux_workstation
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-5q99-f34m-67gc | Maven | org.apache.tomcat.embed:tomcat-embed-core | >=8.5.0 <8.5.34 | 8.5.34 |
| GHSA-5q99-f34m-67gc | Maven | org.apache.tomcat.embed:tomcat-embed-core | >=7.0.23 <7.0.91 | 7.0.91 |
| GHSA-5q99-f34m-67gc | Maven | org.apache.tomcat.embed:tomcat-embed-core | >=9.0.0 <9.0.12 | 9.0.12 |
References
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html
- http://packetstormsecurity.com/files/163456/Apache-Tomcat-9.0.0M1-Open-Redirect.html
- http://www.securityfocus.com/bid/105524
- https://access.redhat.com/errata/RHSA-2019:0130