Published: 04/10/2018 Updated: 08/12/2023

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 4.3 | Impact Score: 1.4 | Exploitability Score: 2.8

VMScore: 384

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache tomcat 9.0.0
apache tomcat
debian debian linux 8.0
canonical ubuntu linux 16.04
canonical ubuntu linux 14.04
netapp snap creator framework -
redhat enterprise linux desktop 7.0
redhat enterprise linux workstation 7.0
redhat enterprise linux server 7.0
redhat enterprise linux server tus 7.6
redhat enterprise linux server eus 7.6
redhat enterprise linux server aus 7.6
redhat enterprise linux server 7.6
oracle hospitality guest access 4.2.0
oracle hospitality guest access 4.2.1
oracle secure global desktop 5.4
oracle retail order broker 5.1
oracle retail order broker 5.2
oracle retail order broker 15.0
oracle communications application session controller 3.7.1
oracle communications application session controller 3.8.0
oracle instantis enterprisetrack 17.1
oracle instantis enterprisetrack 17.2
oracle instantis enterprisetrack 17.3

Tomcat could be made to redirect to arbitrary locations ...

Several issues were discovered in the Tomcat servlet and JSP engine, which could result in session fixation attacks, information disclosure, cross-site scripting, denial of service via resource exhaustion and insecure redirects For the oldstable distribution (stretch), these problems have been fixed in version 8550-0+deb9u1 This update also req ...

Synopsis Moderate: tomcat security update Type/Severity Security Advisory: Moderate Topic An update for tomcat is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, whic ...

Synopsis Moderate: Red Hat JBoss Web Server 31 Service Pack 6 security and bug fix update Type/Severity Security Advisory: Moderate Topic An update is now available for Red Hat JBoss Web Server 31 for RHEL 6 and Red Hat JBoss Web Server 31 for RHEL 7Red Hat Product Security has rated this release as hav ...

Synopsis Important: Red Hat JBoss Web Server 50 Service Pack 1 security and bug fix update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Web Server 50 for RHEL 6 and Red Hat JBoss Web Server 50 for RHEL 7Red Hat Product Security has rated this release as h ...

Synopsis Important: pki-deps:106 security update Type/Severity Security Advisory: Important Topic An update for the pki-deps:106 module is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring Sy ...

Synopsis Moderate: Red Hat JBoss Web Server 31 Service Pack 6 security and bug fix update Type/Severity Security Advisory: Moderate Topic An update is now available for Red Hat JBoss Web Server 31Red Hat Product Security has rated this release as having a security impactof Moderate A Common Vulnerabilit ...

When the default servlet in Apache Tomcat returned a redirect to a directory (eg redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice(CVE-2018-11784) ...

When the default servlet in Apache Tomcat versions 7023 to 7090 returned a redirect to a directory (eg redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice(CVE-2018-11784) ...

When the default servlet in Apache Tomcat versions 900M1 to 9011, 850 to 8533 and 7023 to 7090 returned a redirect to a directory (eg redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice ...

These are details on an open redirection vulnerability in Apache Tomcat version 900M1 that was discovered in 2018 ...

Language Server using LSP meant to be used by IDEs as Snyk Backend for Frontends

Snyk Language Server (Snyk-LS) Supported features The language server follows the Language Server Protocol and integrates with Snyk Open Source, Snyk Infrastructure as Code and Snyk Code For the former two, it uses the Snyk CLI as a data provider, for the latter it is connecting directly to the Snyk Code API Right now the language server supports the following actions: Se

Vulnmap Language Server (Vulnmap-LS) Supported features The language server follows the Language Server Protocol and integrates with Vulnmap Open Source, Vulnmap Infrastructure as Code and Vulnmap Code For the former two, it uses the Vulnmap CLI as a data provider, for the latter it is connecting directly to the Vulnmap Code API Right now the language server supports the f

Get Started

CVE-2018-11784

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect