QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2018-11784

Back to search

CVE-2018-11784

Published: Oct 4, 2018

Modified: Sep 16, 2024

PUBLISHED

Description

When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.

VendorProductVersions

Apache Software Foundation

Apache Tomcat

affected
9.0.0.M1 to 9.0.11
affected
8.5.0 to 8.5.33
affected
7.0.23 to 7.0.90

References

105524
vdb-entry
x_refsource_BID
RHSA-2019:0131
vendor-advisory
x_refsource_REDHAT
RHSA-2019:0485
vendor-advisory
x_refsource_REDHAT
RHSA-2019:0130
vendor-advisory
x_refsource_REDHAT
USN-3787-1
vendor-advisory
x_refsource_UBUNTU
FEDORA-2018-b18f9dd65b
vendor-advisory
x_refsource_FEDORA
openSUSE-SU-2019:1547
vendor-advisory
x_refsource_SUSE
RHSA-2019:1529
vendor-advisory
x_refsource_REDHAT
openSUSE-SU-2019:1814
vendor-advisory
x_refsource_SUSE
DSA-4596
vendor-advisory
x_refsource_DEBIAN

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now