Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2018-11784

CWE-601 — Open RedirectCWE-9915 documents11 sources
Severity
4.3MEDIUM
EPSS
82.6%
top 0.77%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
15
Apache TomcatApache Software Foundation Apache TomcatCanonical Ubuntu Linux+12 more
Timeline
PublishedOct 4
Latest updateMar 18

Description

When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages13 packages

▶NVDapache/tomcat7.0.23 — 7.0.90+3
▶CVEListV5apache_software_foundation/apache_tomcat7.0.23 to 7.0.90, 8.5.0 to 8.5.33, 9.0.0.M1 to 9.0.11+2
▶Ubuntutomcat7< 7.0.52-1ubuntu0.16
▶Ubuntutomcat8< 8.0.32-1ubuntu1.8+1

Also affects: Debian Linux 8.0, Ubuntu Linux 14.04, 16.04, Enterprise Linux 7.6

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

5
GHSA
Open Redirect↗2022-03-18
▶
OSV
Apache Tomcat Open Redirect vulnerability↗2018-10-17
▶
GHSA
Apache Tomcat Open Redirect vulnerability↗2018-10-17
▶
OSV
CVE-2018-11784: When the default servlet in Apache Tomcat versions 9↗2018-10-04
▶
CVEList
CVE-2018-11784: When the default servlet in Apache Tomcat versions 9↗2018-10-04
▶

💥Exploits & PoCs

2
Exploit-DB
Apache Tomcat 9.0.0.M1 - Open Redirect↗2021-07-13
▶
Nuclei
Apache Tomcat - Open Redirect
▶

📋Vendor Advisories

4
Ubuntu
Tomcat vulnerability↗2018-10-10
▶
Red Hat
tomcat: Open redirect in default servlet↗2018-10-03
▶
Debian
CVE-2018-11784: tomcat9 - When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to ...↗2018
▶
Apache
Apache tomcat: CVE-2018-11784↗
▶

💬Community

3
Bugzilla
CVE-2018-11784 tomcat: Open redirect in default servlet [fedora-all]↗2018-10-05
▶
Bugzilla
CVE-2018-11784 tomcat: Open redirect in default servlet↗2018-10-05
▶
Bugzilla
CVE-2018-11784 tomcat: Open redirect in default servlet [epel-all]↗2018-10-05
▶
CVE-2018-11784 (MEDIUM CVSS 4.3) | When the default servlet in Apache | cvebase.io