When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.0 Base Score: 4.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade glassfish-jaxb-apiUpgrade python3-nssUpgrade stax-exUpgrade bea-stax-apiUpgrade glassfish-jaxb-runtimeUpgrade python-nss-docUpgrade slf4jUpgrade xml-commons-apisUpgrade velocityUpgrade jackson-module-jaxb-annotationsUpgrade slf4j-jdk14Upgrade apache-commons-langUpgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-txw2Upgrade xmlstreambufferUpgrade glassfish-jaxb-coreUpgrade javassistUpgrade xsomUpgrade xerces-j2Upgrade javassist-javadocUpgrade xalan-j2Upgrade xml-commons-resolverUpgrade apache-commons-collectionsUpgrade glassfish-fastinfosetUpgrade relaxngDatatype | May 13, 2022 | Oct 4, 2018 |
| Amazon Linux Ami 2 | — | Upgrade tomcat-javadocUpgrade tomcatUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-jsvcUpgrade tomcat-docs-webappUpgrade tomcat-webappsUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcat-el-2.2-apiUpgrade tomcat-lib | Apr 27, 2020 | Oct 4, 2018 |
| Amazon_linux | — | Upgrade tomcat7Upgrade tomcat8 | Nov 8, 2018 | Oct 4, 2018 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 8.5.34Upgrade Apache Tomcat to 7.0.91Upgrade Apache Tomcat to 9.0.12Upgrade Apache Tomcat to the latest available version | Oct 4, 2018 | Oct 4, 2018 |
| Centos_linux | — | Upgrade velocityUpgrade xml-commons-apisUpgrade tomcat-admin-webappsUpgrade bea-stax-apiUpgrade tomcat-el-2.2-apiUpgrade stax-exUpgrade slf4j-jdk14Upgrade javassistUpgrade python-nss-debugsourceUpgrade tomcat-javadocUpgrade jakarta-commons-httpclientUpgrade tomcat-libUpgrade jackson-annotationsUpgrade slf4jUpgrade jackson-module-jaxb-annotationsUpgrade python3-nssUpgrade python-nss-docUpgrade glassfish-jaxb-apiUpgrade jackson-jaxrs-providersUpgrade pki-servlet-containerUpgrade relaxngDatatypeUpgrade glassfish-fastinfosetUpgrade xalan-j2Upgrade glassfish-jaxb-coreUpgrade xerces-j2Upgrade pki-servlet-4.0-apiUpgrade apache-commons-langUpgrade glassfish-jaxb-runtimeUpgrade python3-nss-debuginfoUpgrade tomcat-jsvcUpgrade xsomUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-docs-webappUpgrade javassist-javadocUpgrade jackson-databindUpgrade tomcat-jsp-2.2-apiUpgrade xmlstreambufferUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-txw2Upgrade jackson-coreUpgrade resteasyUpgrade apache-commons-collectionsUpgrade tomcat-webappsUpgrade tomcatUpgrade xml-commons-resolver | Apr 1, 2019 | Oct 4, 2018 |
| Debian | — | Upgrade tomcat8Upgrade tomcat9Upgrade tomcat7 | Feb 19, 2019 | Oct 4, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade tomcat-el-2.2-apiUpgrade tomcat-libUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcat-webappsUpgrade tomcat | Sep 25, 2019 | Oct 4, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade tomcat-webappsUpgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade tomcat-el-2.2-apiUpgrade tomcatUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-jsp-2.2-api | May 30, 2019 | Oct 4, 2018 |
| Huawei Euleros 2_0_sp8 | — | Upgrade tomcat-jsp-2.3-apiUpgrade tomcat-libUpgrade tomcatUpgrade tomcat-admin-webappsUpgrade tomcat-el-3.0-apiUpgrade tomcat-servlet-4.0-api | Jul 26, 2019 | Oct 4, 2018 |
| Oracle Missing Cpu Oct 2019 | — | Apply the October 2019 Critical Patch Update (CPU) for Oracle Database | Oct 17, 2019 | Oct 4, 2018 |
| Oracle Solaris | — | Upgrade web/java-servlet/tomcat-8 to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.34-11.4.3.0.1.4.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8 to version 8.5.34-11.4.3.0.1.4.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.34-11.4.3.0.1.4.0 on Solaris 11.4 | Nov 19, 2018 | Oct 4, 2018 |
| Oracle_linux | — | Upgrade glassfish-jaxb-txw2Upgrade javassist-javadocUpgrade apache-commons-collectionsUpgrade xalan-j2Upgrade tomcat-docs-webappUpgrade tomcat-jsvcUpgrade xsomUpgrade xml-commons-resolverUpgrade pki-servlet-4.0-apiUpgrade tomcat-servlet-3.0-apiUpgrade jackson-annotationsUpgrade slf4jUpgrade jackson-module-jaxb-annotationsUpgrade python-nss-docUpgrade tomcatUpgrade jackson-coreUpgrade glassfish-jaxb-runtimeUpgrade relaxngDatatypeUpgrade glassfish-fastinfosetUpgrade velocityUpgrade javassistUpgrade slf4j-jdk14Upgrade glassfish-jaxb-apiUpgrade tomcat-webappsUpgrade resteasyUpgrade xmlstreambufferUpgrade apache-commons-langUpgrade jakarta-commons-httpclientUpgrade tomcat-admin-webappsUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-libUpgrade glassfish-jaxb-coreUpgrade xerces-j2Upgrade xml-commons-apisUpgrade jackson-jaxrs-json-providerUpgrade stax-exUpgrade python3-nssUpgrade jackson-databindUpgrade jackson-jaxrs-providersUpgrade tomcat-javadocUpgrade pki-servlet-containerUpgrade tomcat-el-2.2-apiUpgrade bea-stax-api | Mar 14, 2019 | Oct 3, 2018 |
| Red Hat Jboss Eap | — | — | Sep 19, 2024 | Oct 3, 2018 |
| Redhat_linux | — | Upgrade javassist-javadocUpgrade slf4jUpgrade xsomUpgrade python-nss-debugsourceUpgrade jackson-module-jaxb-annotationsUpgrade glassfish-jaxb-runtimeUpgrade xml-commons-resolverUpgrade apache-commons-collectionsUpgrade python-nss-docUpgrade pki-servlet-4.0-apiUpgrade python3-nss-debuginfoUpgrade relaxngDatatypeUpgrade xalan-j2Upgrade jackson-annotationsUpgrade jackson-coreUpgrade glassfish-jaxb-txw2Upgrade pki-servlet-containerUpgrade javassistUpgrade jackson-jaxrs-providersUpgrade python3-nssUpgrade jackson-jaxrs-json-providerUpgrade slf4j-jdk14Upgrade glassfish-jaxb-coreUpgrade stax-exUpgrade glassfish-jaxb-apiUpgrade resteasyUpgrade velocityUpgrade bea-stax-apiUpgrade jakarta-commons-httpclientUpgrade xml-commons-apisUpgrade apache-commons-langUpgrade xmlstreambufferUpgrade glassfish-fastinfosetUpgrade jackson-databindUpgrade xerces-j2 | Mar 14, 2019 | Oct 4, 2018 |
| Rocky_linux | — | Upgrade python3-nss-debuginfoUpgrade python-nss-docUpgrade python-nss-debugsourceUpgrade python3-nss | Mar 12, 2024 | Oct 4, 2018 |
| Suse | — | Upgrade tomcat-el-3_0-apiUpgrade tomcat6-admin-webappsUpgrade tomcat-jsp-2_3-apiUpgrade tomcatUpgrade virtualbox-host-kmp-defaultUpgrade virtualbox-develUpgrade virtualbox-guest-x11Upgrade tomcat6-servlet-2_5-apiUpgrade tomcat6Upgrade tomcat6-webappsUpgrade virtualbox-websrvUpgrade virtualbox-vncUpgrade tomcat-jsvcUpgrade tomcat-servlet-3_0-apiUpgrade tomcat-embedUpgrade tomcat6-docs-webappUpgrade tomcat-docs-webappUpgrade virtualbox-guest-sourceUpgrade virtualbox-guest-desktop-iconsUpgrade tomcat-admin-webappsUpgrade tomcat6-javadocUpgrade tomcat6-jsp-2_1-apiUpgrade tomcat-servlet-3_1-apiUpgrade virtualbox-host-sourceUpgrade tomcat-javadocUpgrade tomcat-el-2_2-apiUpgrade virtualbox-guest-toolsUpgrade virtualboxUpgrade tomcat-servlet-4_0-apiUpgrade tomcat6-libUpgrade tomcat-libUpgrade virtualbox-qtUpgrade virtualbox-guest-kmp-defaultUpgrade tomcat-jsp-2_2-apiUpgrade tomcat-webappsUpgrade python3-virtualbox | Oct 20, 2018 | Oct 4, 2018 |
| Ubuntu | — | Upgrade libtomcat8-javaUpgrade libtomcat7-javaUpgrade tomcat7Upgrade tomcat8 | Oct 18, 2018 | Oct 4, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub