When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.0 Base Score: 4.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade xml-commons-apisUpgrade stax-exUpgrade apache-commons-langUpgrade glassfish-jaxb-apiUpgrade slf4j-jdk14Upgrade velocityUpgrade bea-stax-apiUpgrade python3-nssUpgrade python-nss-docUpgrade glassfish-jaxb-runtimeUpgrade jackson-module-jaxb-annotationsUpgrade slf4jUpgrade javassistUpgrade xml-commons-resolverUpgrade xmlstreambufferUpgrade glassfish-jaxb-txw2Upgrade jakarta-commons-httpclientUpgrade javassist-javadocUpgrade glassfish-jaxb-coreUpgrade xerces-j2Upgrade glassfish-fastinfosetUpgrade xalan-j2Upgrade apache-commons-collectionsUpgrade xsomUpgrade relaxngDatatype | May 13, 2022 | Oct 4, 2018 |
| Amazon Linux Ami 2 | — | Upgrade tomcat-servlet-3.0-apiUpgrade tomcat-webappsUpgrade tomcat-docs-webappUpgrade tomcat-jsp-2.2-apiUpgrade tomcatUpgrade tomcat-javadocUpgrade tomcat-jsvcUpgrade tomcat-admin-webappsUpgrade tomcat-libUpgrade tomcat-el-2.2-api | Apr 27, 2020 | Oct 4, 2018 |
| Amazon_linux | — | Upgrade tomcat8Upgrade tomcat7 | Nov 8, 2018 | Oct 4, 2018 |
| Apache Tomcat | — | Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 9.0.12Upgrade Apache Tomcat to 8.5.34Upgrade Apache Tomcat to 7.0.91 | Oct 4, 2018 | Oct 4, 2018 |
| Centos_linux | — | Upgrade slf4j-jdk14Upgrade xml-commons-apisUpgrade velocityUpgrade bea-stax-apiUpgrade tomcat-javadocUpgrade jackson-annotationsUpgrade javassistUpgrade jackson-module-jaxb-annotationsUpgrade jackson-jaxrs-providersUpgrade pki-servlet-containerUpgrade slf4jUpgrade python-nss-debugsourceUpgrade python3-nssUpgrade jakarta-commons-httpclientUpgrade python-nss-docUpgrade stax-exUpgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade glassfish-jaxb-apiUpgrade tomcat-el-2.2-apiUpgrade xalan-j2Upgrade relaxngDatatypeUpgrade xsomUpgrade tomcat-webappsUpgrade apache-commons-collectionsUpgrade tomcat-docs-webappUpgrade xmlstreambufferUpgrade apache-commons-langUpgrade jackson-coreUpgrade resteasyUpgrade jackson-databindUpgrade tomcatUpgrade glassfish-fastinfosetUpgrade python3-nss-debuginfoUpgrade tomcat-jsvcUpgrade glassfish-jaxb-runtimeUpgrade javassist-javadocUpgrade jackson-jaxrs-json-providerUpgrade pki-servlet-4.0-apiUpgrade glassfish-jaxb-txw2Upgrade xml-commons-resolverUpgrade glassfish-jaxb-coreUpgrade xerces-j2Upgrade tomcat-servlet-3.0-apiUpgrade tomcat-jsp-2.2-api | Apr 1, 2019 | Oct 4, 2018 |
| Debian | — | Upgrade tomcat9Upgrade tomcat7Upgrade tomcat8 | Feb 19, 2019 | Oct 4, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade tomcat-servlet-3.0-apiUpgrade tomcat-libUpgrade tomcat-el-2.2-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcat-webappsUpgrade tomcat | Sep 25, 2019 | Oct 4, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade tomcat-webappsUpgrade tomcat-libUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcatUpgrade tomcat-admin-webappsUpgrade tomcat-el-2.2-api | May 30, 2019 | Oct 4, 2018 |
| Huawei Euleros 2_0_sp8 | — | Upgrade tomcat-libUpgrade tomcatUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-el-3.0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-4.0-api | Jul 26, 2019 | Oct 4, 2018 |
| Oracle Missing Cpu Oct 2019 | — | Apply the October 2019 Critical Patch Update (CPU) for Oracle Database | Oct 17, 2019 | Oct 4, 2018 |
| Oracle Solaris | — | Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.34-11.4.3.0.1.4.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.34-11.4.3.0.1.4.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8 to version 8.5.34-11.4.3.0.1.4.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8 to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3 | Nov 19, 2018 | Oct 4, 2018 |
| Oracle_linux | — | Upgrade tomcat-jsvcUpgrade jackson-coreUpgrade xsomUpgrade relaxngDatatypeUpgrade tomcat-servlet-3.0-apiUpgrade javassist-javadocUpgrade apache-commons-collectionsUpgrade xml-commons-resolverUpgrade pki-servlet-4.0-apiUpgrade tomcat-docs-webappUpgrade jackson-module-jaxb-annotationsUpgrade python-nss-docUpgrade tomcatUpgrade glassfish-jaxb-txw2Upgrade xalan-j2Upgrade glassfish-jaxb-runtimeUpgrade slf4jUpgrade jackson-annotationsUpgrade jackson-jaxrs-providersUpgrade tomcat-jsp-2.2-apiUpgrade glassfish-jaxb-coreUpgrade tomcat-javadocUpgrade stax-exUpgrade apache-commons-langUpgrade jakarta-commons-httpclientUpgrade tomcat-webappsUpgrade resteasyUpgrade pki-servlet-containerUpgrade tomcat-el-2.2-apiUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-apiUpgrade slf4j-jdk14Upgrade tomcat-libUpgrade javassistUpgrade xml-commons-apisUpgrade python3-nssUpgrade tomcat-admin-webappsUpgrade bea-stax-apiUpgrade jackson-databindUpgrade xerces-j2Upgrade jackson-jaxrs-json-providerUpgrade velocityUpgrade xmlstreambuffer | Mar 14, 2019 | Oct 3, 2018 |
| Red Hat Jboss Eap | — | — | Sep 19, 2024 | Oct 3, 2018 |
| Redhat_linux | — | Upgrade jackson-module-jaxb-annotationsUpgrade glassfish-jaxb-runtimeUpgrade python-nss-debugsourceUpgrade apache-commons-collectionsUpgrade xalan-j2Upgrade javassist-javadocUpgrade jackson-coreUpgrade glassfish-jaxb-txw2Upgrade jackson-annotationsUpgrade xsomUpgrade python-nss-docUpgrade slf4jUpgrade pki-servlet-4.0-apiUpgrade xml-commons-resolverUpgrade relaxngDatatypeUpgrade python3-nss-debuginfoUpgrade python3-nssUpgrade jackson-jaxrs-providersUpgrade apache-commons-langUpgrade bea-stax-apiUpgrade resteasyUpgrade pki-servlet-containerUpgrade xmlstreambufferUpgrade jackson-jaxrs-json-providerUpgrade slf4j-jdk14Upgrade xerces-j2Upgrade jakarta-commons-httpclientUpgrade stax-exUpgrade glassfish-fastinfosetUpgrade velocityUpgrade jackson-databindUpgrade xml-commons-apisUpgrade glassfish-jaxb-coreUpgrade javassistUpgrade glassfish-jaxb-api | Mar 14, 2019 | Oct 4, 2018 |
| Rocky_linux | — | Upgrade python-nss-docUpgrade python3-nss-debuginfoUpgrade python-nss-debugsourceUpgrade python3-nss | Mar 12, 2024 | Oct 4, 2018 |
| Suse | — | Upgrade tomcat-jsvcUpgrade virtualbox-websrvUpgrade virtualbox-guest-x11Upgrade virtualbox-guest-sourceUpgrade tomcat-servlet-3_0-apiUpgrade virtualbox-vncUpgrade tomcat6Upgrade tomcat-embedUpgrade tomcat6-docs-webappUpgrade virtualbox-host-kmp-defaultUpgrade tomcat-docs-webappUpgrade virtualbox-develUpgrade tomcat-jsp-2_3-apiUpgrade tomcat6-webappsUpgrade tomcat-el-3_0-apiUpgrade tomcat6-servlet-2_5-apiUpgrade tomcat6-admin-webappsUpgrade tomcatUpgrade virtualbox-guest-kmp-defaultUpgrade tomcat-servlet-3_1-apiUpgrade virtualbox-host-sourceUpgrade tomcat-jsp-2_2-apiUpgrade virtualbox-qtUpgrade tomcat-webappsUpgrade tomcat-servlet-4_0-apiUpgrade tomcat6-libUpgrade virtualbox-guest-desktop-iconsUpgrade tomcat-el-2_2-apiUpgrade tomcat-javadocUpgrade tomcat6-javadocUpgrade tomcat6-jsp-2_1-apiUpgrade python3-virtualboxUpgrade virtualbox-guest-toolsUpgrade tomcat-admin-webappsUpgrade tomcat-libUpgrade virtualbox | Oct 20, 2018 | Oct 4, 2018 |
| Ubuntu | — | Upgrade tomcat8Upgrade libtomcat7-javaUpgrade tomcat7Upgrade libtomcat8-java | Oct 18, 2018 | Oct 4, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub