The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. Older, EOL versions may also be affected.
The vulnerability is limited to the ROOT (default) web application.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade tomcat-webappsUpgrade tomcatUpgrade tomcat-docs-webappUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-libUpgrade tomcat-el-3.0-api | Jan 18, 2024 | Aug 25, 2023 |
| Amazon Linux Ami 2 | — | Upgrade tomcat-admin-webappsUpgrade tomcat-servlet-3.1-apiUpgrade tomcat-webappsUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-javadocUpgrade tomcat-libUpgrade tomcat-docs-webappUpgrade tomcatUpgrade tomcat-el-3.0-apiUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-jsvc | Sep 28, 2023 | Aug 25, 2023 |
| Amazon_linux | — | Upgrade tomcat8 | Oct 25, 2023 | Aug 25, 2023 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 9.0.80Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 11.0.0Upgrade Apache Tomcat to 10.1.13Upgrade Apache Tomcat to 8.5.93 | Aug 28, 2023 | Aug 25, 2023 |
| Centos_linux | — | Upgrade tomcat-libUpgrade tomcat-webappsUpgrade tomcat-el-3.0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-docs-webappUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-jsp-2.3-apiUpgrade tomcat | Jan 11, 2024 | Aug 25, 2023 |
| Debian | — | Upgrade tomcat10Upgrade tomcat9 | Oct 12, 2023 | Aug 25, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade tomcat-libUpgrade tomcat-jsp-2.3-apiUpgrade tomcatUpgrade tomcat-admin-webappsUpgrade tomcat-el-3.0-apiUpgrade tomcat-servlet-4.0-api | Mar 13, 2024 | Aug 25, 2023 |
| Oracle_linux | — | Upgrade tomcat-admin-webappsUpgrade tomcat-libUpgrade tomcatUpgrade tomcat-el-3.0-apiUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-webappsUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-docs-webapp | Jan 11, 2024 | Aug 28, 2023 |
| Red Hat Jboss Eap | — | — | Sep 19, 2024 | Aug 28, 2023 |
| Redhat_linux | — | Upgrade tomcat-admin-webappsNo solution existsUpgrade tomcat-docs-webappUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-el-3.0-apiUpgrade tomcat-libUpgrade tomcat-webappsUpgrade tomcat | Jan 11, 2024 | Aug 25, 2023 |
| Suse | — | Upgrade tomcat-docs-webappUpgrade tomcat-webappsUpgrade tomcat-jsvcUpgrade tomcat-javadocUpgrade tomcat-jsp-2_3-apiUpgrade tomcatUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-libUpgrade tomcat-el-3_0-apiUpgrade tomcat-embedUpgrade tomcat-admin-webapps | Oct 6, 2023 | Aug 25, 2023 |
| Ubuntu | — | Upgrade tomcat9 (Ubuntu Pro)Upgrade libtomcat9-javaUpgrade libtomcat9-java (Ubuntu Pro)Upgrade tomcat9 | Nov 19, 2024 | Aug 25, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub