GHSA-5q99-f34m-67gcMediumCVSS 4.3

Apache Tomcat Open Redirect vulnerability

Published
October 17, 2018
Last Modified
February 22, 2024

🔗 CVE IDs covered (1)

CVE-2018-11784 →

📋 Description

When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.

🎯 Affected products3

  • maven/org.apache.tomcat.embed:tomcat-embed-core:>= 8.5.0, < 8.5.34
  • maven/org.apache.tomcat.embed:tomcat-embed-core:>= 7.0.23, < 7.0.91
  • maven/org.apache.tomcat.embed:tomcat-embed-core:>= 9.0.0, < 9.0.12

🔗 References (62)