URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. Older, EOL versions may also be affected.
The vulnerability is limited to the ROOT (default) web application.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade tomcat-webappsUpgrade tomcat-docs-webappUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-admin-webappsUpgrade tomcatUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-libUpgrade tomcat-el-3.0-api | Jan 18, 2024 | Aug 25, 2023 |
| Amazon Linux Ami 2 | — | Upgrade tomcat-el-3.0-apiUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-docs-webappUpgrade tomcat-jsvcUpgrade tomcatUpgrade tomcat-libUpgrade tomcat-webappsUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-admin-webappsUpgrade tomcat-javadocUpgrade tomcat-servlet-3.1-api | Sep 28, 2023 | Aug 25, 2023 |
| Amazon_linux | — | Upgrade tomcat8 | Oct 25, 2023 | Aug 25, 2023 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 8.5.93Upgrade Apache Tomcat to 10.1.13Upgrade Apache Tomcat to 11.0.0Upgrade Apache Tomcat to 9.0.80Upgrade Apache Tomcat to the latest available version | Aug 28, 2023 | Aug 25, 2023 |
| Centos_linux | — | Upgrade tomcat-webappsUpgrade tomcat-libUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-docs-webappUpgrade tomcat-admin-webappsUpgrade tomcat-el-3.0-apiUpgrade tomcat-servlet-4.0-apiUpgrade tomcat | Jan 11, 2024 | Aug 25, 2023 |
| Debian | — | Upgrade tomcat9Upgrade tomcat10 | Oct 12, 2023 | Aug 25, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade tomcat-admin-webappsUpgrade tomcat-servlet-4.0-apiUpgrade tomcatUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-el-3.0-apiUpgrade tomcat-lib | Mar 13, 2024 | Aug 25, 2023 |
| Oracle_linux | — | Upgrade tomcat-docs-webappUpgrade tomcatUpgrade tomcat-el-3.0-apiUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-webappsUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-libUpgrade tomcat-admin-webapps | Jan 11, 2024 | Aug 28, 2023 |
| Red Hat Jboss Eap | — | — | Sep 19, 2024 | Aug 28, 2023 |
| Redhat_linux | — | Upgrade tomcat-docs-webappNo solution existsUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-admin-webappsUpgrade tomcatUpgrade tomcat-libUpgrade tomcat-el-3.0-apiUpgrade tomcat-webapps | Jan 11, 2024 | Aug 25, 2023 |
| Suse | — | Upgrade tomcat-el-3_0-apiUpgrade tomcat-libUpgrade tomcat-embedUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-jsp-2_3-apiUpgrade tomcatUpgrade tomcat-webappsUpgrade tomcat-jsvcUpgrade tomcat-docs-webappUpgrade tomcat-javadoc | Oct 6, 2023 | Aug 25, 2023 |
| Ubuntu | — | Upgrade libtomcat9-java (Ubuntu Pro)Upgrade tomcat9Upgrade libtomcat9-javaUpgrade tomcat9 (Ubuntu Pro) | Nov 19, 2024 | Aug 25, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub