When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.0 Base Score: 4.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade glassfish-jaxb-coreUpgrade xsomUpgrade relaxngDatatypeUpgrade xalan-j2Upgrade glassfish-jaxb-txw2Upgrade xmlstreambufferUpgrade jakarta-commons-httpclientUpgrade apache-commons-collectionsUpgrade xml-commons-resolverUpgrade javassist-javadocUpgrade javassistUpgrade glassfish-fastinfosetUpgrade xerces-j2Upgrade slf4j-jdk14Upgrade glassfish-jaxb-runtimeUpgrade glassfish-jaxb-apiUpgrade python-nss-docUpgrade python3-nssUpgrade apache-commons-langUpgrade xml-commons-apisUpgrade slf4jUpgrade velocityUpgrade stax-exUpgrade jackson-module-jaxb-annotationsUpgrade bea-stax-api | May 13, 2022 | Oct 4, 2018 |
| Amazon Linux Ami 2 | — | Upgrade tomcat-webappsUpgrade tomcat-javadocUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-jsvcUpgrade tomcatUpgrade tomcat-docs-webappUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade tomcat-el-2.2-api | Apr 27, 2020 | Oct 4, 2018 |
| Amazon_linux | — | Upgrade tomcat7Upgrade tomcat8 | Nov 8, 2018 | Oct 4, 2018 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 7.0.91Upgrade Apache Tomcat to 8.5.34Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 9.0.12 | Oct 4, 2018 | Oct 4, 2018 |
| Centos_linux | — | Upgrade tomcat-docs-webappUpgrade xsomUpgrade apache-commons-collectionsUpgrade glassfish-fastinfosetUpgrade tomcat-webappsUpgrade tomcatUpgrade xalan-j2Upgrade resteasyUpgrade xml-commons-resolverUpgrade xmlstreambufferUpgrade pki-servlet-4.0-apiUpgrade glassfish-jaxb-txw2Upgrade jackson-coreUpgrade apache-commons-langUpgrade tomcat-jsvcUpgrade python3-nss-debuginfoUpgrade javassist-javadocUpgrade jackson-databindUpgrade glassfish-jaxb-runtimeUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-coreUpgrade relaxngDatatypeUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-servlet-3.0-apiUpgrade xerces-j2Upgrade tomcat-admin-webappsUpgrade velocityUpgrade tomcat-javadocUpgrade tomcat-el-2.2-apiUpgrade slf4j-jdk14Upgrade jackson-annotationsUpgrade javassistUpgrade jackson-module-jaxb-annotationsUpgrade jakarta-commons-httpclientUpgrade jackson-jaxrs-providersUpgrade glassfish-jaxb-apiUpgrade stax-exUpgrade tomcat-libUpgrade slf4jUpgrade python3-nssUpgrade python-nss-docUpgrade bea-stax-apiUpgrade python-nss-debugsourceUpgrade xml-commons-apisUpgrade pki-servlet-container | Apr 1, 2019 | Oct 4, 2018 |
| Debian | — | Upgrade tomcat7Upgrade tomcat9Upgrade tomcat8 | Feb 19, 2019 | Oct 4, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade tomcat-el-2.2-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-libUpgrade tomcatUpgrade tomcat-webappsUpgrade tomcat-admin-webapps | Sep 25, 2019 | Oct 4, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade tomcat-admin-webappsUpgrade tomcatUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-el-2.2-apiUpgrade tomcat-webappsUpgrade tomcat-lib | May 30, 2019 | Oct 4, 2018 |
| Huawei Euleros 2_0_sp8 | — | Upgrade tomcat-libUpgrade tomcat-jsp-2.3-apiUpgrade tomcatUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-el-3.0-apiUpgrade tomcat-admin-webapps | Jul 26, 2019 | Oct 4, 2018 |
| Oracle Missing Cpu Oct 2019 | — | Apply the October 2019 Critical Patch Update (CPU) for Oracle Database | Oct 17, 2019 | Oct 4, 2018 |
| Oracle Solaris | — | Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.34-11.4.3.0.1.4.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8 to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8 to version 8.5.34-11.4.3.0.1.4.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.34-11.4.3.0.1.4.0 on Solaris 11.4 | Nov 19, 2018 | Oct 4, 2018 |
| Oracle_linux | — | Upgrade python-nss-docUpgrade jackson-module-jaxb-annotationsUpgrade xml-commons-resolverUpgrade tomcat-docs-webappUpgrade tomcatUpgrade slf4jUpgrade tomcat-servlet-3.0-apiUpgrade glassfish-jaxb-runtimeUpgrade relaxngDatatypeUpgrade xalan-j2Upgrade xsomUpgrade glassfish-jaxb-txw2Upgrade apache-commons-collectionsUpgrade javassist-javadocUpgrade pki-servlet-4.0-apiUpgrade tomcat-jsvcUpgrade jackson-annotationsUpgrade jackson-coreUpgrade jackson-databindUpgrade tomcat-webappsUpgrade pki-servlet-containerUpgrade tomcat-jsp-2.2-apiUpgrade velocityUpgrade xerces-j2Upgrade tomcat-admin-webappsUpgrade python3-nssUpgrade xml-commons-apisUpgrade bea-stax-apiUpgrade tomcat-libUpgrade glassfish-jaxb-apiUpgrade slf4j-jdk14Upgrade glassfish-fastinfosetUpgrade javassistUpgrade jackson-jaxrs-json-providerUpgrade tomcat-javadocUpgrade tomcat-el-2.2-apiUpgrade glassfish-jaxb-coreUpgrade resteasyUpgrade jackson-jaxrs-providersUpgrade jakarta-commons-httpclientUpgrade stax-exUpgrade apache-commons-langUpgrade xmlstreambuffer | Mar 14, 2019 | Oct 3, 2018 |
| Red Hat Jboss Eap | — | — | Sep 19, 2024 | Oct 3, 2018 |
| Redhat_linux | — | Upgrade xml-commons-apisUpgrade stax-exUpgrade glassfish-jaxb-coreUpgrade xmlstreambufferUpgrade jackson-jaxrs-providersUpgrade glassfish-jaxb-apiUpgrade jackson-databindUpgrade jackson-jaxrs-json-providerUpgrade jakarta-commons-httpclientUpgrade pki-servlet-containerUpgrade xerces-j2Upgrade slf4j-jdk14Upgrade velocityUpgrade resteasyUpgrade python3-nssUpgrade apache-commons-langUpgrade glassfish-fastinfosetUpgrade javassistUpgrade bea-stax-apiUpgrade pki-servlet-4.0-apiUpgrade xalan-j2Upgrade jackson-coreUpgrade jackson-annotationsUpgrade xml-commons-resolverUpgrade jackson-module-jaxb-annotationsUpgrade apache-commons-collectionsUpgrade xsomUpgrade relaxngDatatypeUpgrade python3-nss-debuginfoUpgrade python-nss-debugsourceUpgrade glassfish-jaxb-runtimeUpgrade javassist-javadocUpgrade python-nss-docUpgrade glassfish-jaxb-txw2Upgrade slf4j | Mar 14, 2019 | Oct 4, 2018 |
| Rocky_linux | — | Upgrade python-nss-docUpgrade python3-nss-debuginfoUpgrade python-nss-debugsourceUpgrade python3-nss | Mar 12, 2024 | Oct 4, 2018 |
| Suse | — | Upgrade virtualbox-develUpgrade tomcat6Upgrade virtualbox-websrvUpgrade virtualbox-vncUpgrade tomcat-docs-webappUpgrade tomcat6-docs-webappUpgrade virtualbox-guest-sourceUpgrade virtualbox-host-kmp-defaultUpgrade tomcat-servlet-3_0-apiUpgrade virtualbox-guest-x11Upgrade tomcat-embedUpgrade tomcatUpgrade tomcat6-servlet-2_5-apiUpgrade tomcat6-webappsUpgrade tomcat-jsvcUpgrade tomcat6-admin-webappsUpgrade tomcat-el-3_0-apiUpgrade tomcat-jsp-2_3-apiUpgrade python3-virtualboxUpgrade tomcat6-libUpgrade tomcat-admin-webappsUpgrade tomcat6-jsp-2_1-apiUpgrade tomcat-javadocUpgrade tomcat-servlet-3_1-apiUpgrade virtualbox-host-sourceUpgrade virtualbox-guest-toolsUpgrade virtualbox-guest-kmp-defaultUpgrade tomcat-jsp-2_2-apiUpgrade tomcat-webappsUpgrade virtualbox-qtUpgrade virtualboxUpgrade tomcat-el-2_2-apiUpgrade virtualbox-guest-desktop-iconsUpgrade tomcat6-javadocUpgrade tomcat-libUpgrade tomcat-servlet-4_0-api | Oct 20, 2018 | Oct 4, 2018 |
| Ubuntu | — | Upgrade libtomcat7-javaUpgrade tomcat7Upgrade libtomcat8-javaUpgrade tomcat8 | Oct 18, 2018 | Oct 4, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub