What’s Vulnerable › Vulnerabilities
CVE-2018-11784
- Severity: medium (CVSS 4.3 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 97.7% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2018-10-04 · updated 2026-10-15
- Weakness: CWE-601
Description
When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.
Affected products
- Apache Tomcat: from 7.0.23 through 7.0.90; from 8.5.0 through 8.5.33; from 9.0.1 through 9.0.11; 9.0.0, 9.0.0-milestone1, 9.0.0-milestone10, 9.0.0-milestone11, 9.0.0-milestone12, 9.0.0-milestone13 (+22)
- Canonical Ubuntu Linux: 14.04, 16.04
- Debian Linux: 8.0
- NetApp Snap Creator Framework: all versions
- Oracle Communications Application Session Controller: 3.7.1, 3.8.0
- Oracle Corporation Hospitality Guest Access: 4.2.0, 4.2.1
- Oracle Instantis Enterprisetrack: 17.1, 17.2, 17.3
- Oracle Retail Order Broker: 5.1, 5.2, 15.0
- Oracle Corporation Secure Global Desktop: 5.4
- RedHat Enterprise Linux Desktop: 7.0
- RedHat Enterprise Linux Server: 7.0, 7.6
- RedHat Enterprise Linux Server Aus: 7.6
- RedHat Enterprise Linux Server Eus: 7.6
- RedHat Enterprise Linux Server Tus: 7.6
- RedHat Enterprise Linux Workstation: 7.0
References
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html
- http://packetstormsecurity.com/files/163456/Apache-Tomcat-9.0.0M1-Open-Redirect.html
- http://www.securityfocus.com/bid/105524
- https://access.redhat.com/errata/RHSA-2019:0130
- https://access.redhat.com/errata/RHSA-2019:0131
- https://access.redhat.com/errata/RHSA-2019:0485
- https://access.redhat.com/errata/RHSA-2019:1529
- https://kc.mcafee.com/corporate/index?page=content&id=SB10284
- https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/23134c9b5a23892a205dc140cdd8c9c0add233600f76b313dda6bd75%40%3Cannounce.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E
Get alerted when CVE-2018-11784 or the next vulnerability affects your stack