CVE-2018-11784 Apache Tomcat Open Redirect vulnerability
MediumCVSS 4.3
EPSS 97.7%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | >= 8.5.0, < 8.5.34 | 8.5.34 |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.0 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.11 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.12 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.13 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.14 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.15 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.16 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.19 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.2 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.20 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.21 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.23 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.24 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.27 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.28 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.29 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.3 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.30 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.31 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.32 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.33 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.4 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.5 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.6 | No fix listed |
Show 117 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.8 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.9 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | >= 7.0.23, < 7.0.91 | 7.0.91 |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.23 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.25 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.26 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.27 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.28 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.29 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.30 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.32 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.33 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.34 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.35 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.37 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.39 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.40 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.41 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.42 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.47 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.50 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.52 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.53 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.54 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.55 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.56 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.57 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.59 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.61 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.62 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.63 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.64 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.65 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.67 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.68 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.69 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.70 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.72 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.73 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.75 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.76 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.77 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.78 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.79 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.81 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.82 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.84 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.85 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.86 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.88 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.90 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | >= 9.0.0, < 9.0.12 | 9.0.12 |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.1 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.10 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.11 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.2 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.4 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.5 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.6 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.7 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.8 | No fix listed |
| Apache Tomcat | = 9.0.0.M1 to 9.0.11 | No fix listed |
| Apache Tomcat | = 8.5.0 to 8.5.33 | No fix listed |
| Apache Tomcat | = 7.0.23 to 7.0.90 | No fix listed |
| apache tomcat | >= 7.0.23, <= 7.0.90 | No fix listed |
| apache tomcat | >= 8.5.0, <= 8.5.33 | No fix listed |
| apache tomcat | >= 9.0.1, <= 9.0.11 | No fix listed |
| apache tomcat | = 9.0.0 | No fix listed |
| apache tomcat | = 9.0.0-milestone1 | No fix listed |
| apache tomcat | = 9.0.0-milestone10 | No fix listed |
| apache tomcat | = 9.0.0-milestone11 | No fix listed |
| apache tomcat | = 9.0.0-milestone12 | No fix listed |
| apache tomcat | = 9.0.0-milestone13 | No fix listed |
| apache tomcat | = 9.0.0-milestone14 | No fix listed |
| apache tomcat | = 9.0.0-milestone15 | No fix listed |
| apache tomcat | = 9.0.0-milestone16 | No fix listed |
| apache tomcat | = 9.0.0-milestone17 | No fix listed |
| apache tomcat | = 9.0.0-milestone18 | No fix listed |
| apache tomcat | = 9.0.0-milestone19 | No fix listed |
| apache tomcat | = 9.0.0-milestone2 | No fix listed |
| apache tomcat | = 9.0.0-milestone20 | No fix listed |
| apache tomcat | = 9.0.0-milestone21 | No fix listed |
| apache tomcat | = 9.0.0-milestone22 | No fix listed |
| apache tomcat | = 9.0.0-milestone23 | No fix listed |
| apache tomcat | = 9.0.0-milestone24 | No fix listed |
| apache tomcat | = 9.0.0-milestone25 | No fix listed |
| apache tomcat | = 9.0.0-milestone26 | No fix listed |
| apache tomcat | = 9.0.0-milestone27 | No fix listed |
| apache tomcat | = 9.0.0-milestone3 | No fix listed |
| apache tomcat | = 9.0.0-milestone4 | No fix listed |
| apache tomcat | = 9.0.0-milestone5 | No fix listed |
| apache tomcat | = 9.0.0-milestone6 | No fix listed |
| apache tomcat | = 9.0.0-milestone7 | No fix listed |
| apache tomcat | = 9.0.0-milestone8 | No fix listed |
| apache tomcat | = 9.0.0-milestone9 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| netapp snap creator framework | All versions | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server | = 7.6 | No fix listed |
| redhat enterprise linux server aus | = 7.6 | No fix listed |
| redhat enterprise linux server eus | = 7.6 | No fix listed |
| redhat enterprise linux server tus | = 7.6 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| oracle communications application session controller | = 3.7.1 | No fix listed |
| oracle communications application session controller | = 3.8.0 | No fix listed |
| oracle hospitality guest access | = 4.2.0 | No fix listed |
| oracle hospitality guest access | = 4.2.1 | No fix listed |
| oracle instantis enterprisetrack | = 17.1 | No fix listed |
| oracle instantis enterprisetrack | = 17.2 | No fix listed |
| oracle instantis enterprisetrack | = 17.3 | No fix listed |
| oracle retail order broker | = 5.1 | No fix listed |
| oracle retail order broker | = 5.2 | No fix listed |
| oracle retail order broker | = 15.0 | No fix listed |
| oracle secure global desktop | = 5.4 | No fix listed |
References
- Debian Security Tracker CVE-2018-11784 vendor-advisory
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- [debian-lts-announce] 20181014 [SECURITY] [DLA 1544-1] tomcat7 security update mailing-list third-party-advisory
- lists.apache.org
- [tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- RHSA-2019:0130 third-party-advisory vendor-advisory
- [debian-lts-announce] 20181015 [SECURITY] [DLA 1545-1] tomcat8 security update mailing-list third-party-advisory
- FEDORA-2018-b18f9dd65b vendor-advisory
- lists.fedoraproject.org
- 20191229 [SECURITY] [DSA 4596-1] tomcat8 security update mailing-list
- security.netapp.com third-party-advisory
- USN-3787-1 third-party-advisory vendor-advisory
- web.archive.org
- DSA-4596 vendor-advisory
- www.oracle.com
- www.oracle.com
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com
- www.oracle.com
- RHSA-2019:0131 third-party-advisory vendor-advisory
- RHSA-2019:0485 third-party-advisory vendor-advisory
- RHSA-2019:1529 vendor-advisory
- github.com vendor-advisory
- github.com product
- kc.mcafee.com
- [tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
- lists.apache.org
- [announce] 20181003 [SECURITY] CVE-2018-11784 Apache Tomcat - Open Redirect mailing-list
- lists.apache.org
- [tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- lists.apache.org
- openSUSE-SU-2019:1547 vendor-advisory
- openSUSE-SU-2019:1814 vendor-advisory
- packetstormsecurity.com exploit
- 105524 third-party-advisory vdb-entry