CVE-2018-11784: Medium severity Apache Tomcat vulnerability
A flaw was found in Apache tomcat. When the default servlet returned a redirect to a directory (e.g. redirecting to /foo/ when the user requested /foo) a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.
References:
https://lists.apache.org/thread.html/23134c9b5a23892a205dc140cdd8c9c0add233600f76b313dda6bd75@%3Cannounce.tomcat.apache.org%3E
Other sources
When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.tomcat.embed:tomcat-embed-coreto a version that resolves this vulnerability.Fixed in 9.0.12 - Upgrade
Upgrade
maven/org.apache.tomcat.embed:tomcat-embed-coreto a version that resolves this vulnerability.Fixed in 7.0.91 - Upgrade
Upgrade
maven/org.apache.tomcat.embed:tomcat-embed-coreto a version that resolves this vulnerability.Fixed in 8.5.34 - Upgrade
Upgrade
debian/tomcat9to a version that resolves this vulnerability.Fixed in 9.0.43-2~deb11u10Fixed in 9.0.107-0+deb11u2Fixed in 9.0.70-2Fixed in 9.0.95-1Fixed in 9.0.115-1 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 9.0.12 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 8.5.34 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 7.0.91
Event History
Frequently Asked Questions
What is the severity of CVE-2018-11784?
CVE-2018-11784 is rated as high severity due to the potential for open redirect vulnerabilities.
How do I fix CVE-2018-11784?
To fix CVE-2018-11784, upgrade to Apache Tomcat version 9.0.12, 8.5.34, or 7.0.91.
Which versions of Apache Tomcat are affected by CVE-2018-11784?
Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33, and 7.0.23 to 7.0.90 are affected by CVE-2018-11784.
What type of attack does CVE-2018-11784 facilitate?
CVE-2018-11784 facilitates open redirect attacks that can be exploited to redirect users to malicious sites.
Is CVE-2018-11784 a remote code execution vulnerability?
No, CVE-2018-11784 is not a remote code execution vulnerability but an open redirect issue.