When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.0 Base Score: 4.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jackson-module-jaxb-annotationsUpgrade glassfish-jaxb-runtimeUpgrade python-nss-docUpgrade glassfish-jaxb-apiUpgrade velocityUpgrade slf4jUpgrade apache-commons-langUpgrade stax-exUpgrade python3-nssUpgrade bea-stax-apiUpgrade xml-commons-apisUpgrade slf4j-jdk14Upgrade javassistUpgrade xmlstreambufferUpgrade apache-commons-collectionsUpgrade javassist-javadocUpgrade xml-commons-resolverUpgrade glassfish-jaxb-txw2Upgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-coreUpgrade xalan-j2Upgrade xerces-j2Upgrade relaxngDatatypeUpgrade glassfish-fastinfosetUpgrade xsom | May 13, 2022 | Oct 4, 2018 |
| Amazon Linux Ami 2 | — | Upgrade tomcatUpgrade tomcat-javadocUpgrade tomcat-docs-webappUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-webappsUpgrade tomcat-jsvcUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcat-el-2.2-apiUpgrade tomcat-lib | Apr 27, 2020 | Oct 4, 2018 |
| Amazon_linux | — | Upgrade tomcat7Upgrade tomcat8 | Nov 8, 2018 | Oct 4, 2018 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 7.0.91Upgrade Apache Tomcat to 8.5.34Upgrade Apache Tomcat to 9.0.12Upgrade Apache Tomcat to the latest available version | Oct 4, 2018 | Oct 4, 2018 |
| Centos_linux | — | Upgrade javassistUpgrade glassfish-jaxb-apiUpgrade slf4j-jdk14Upgrade tomcat-el-2.2-apiUpgrade pki-servlet-containerUpgrade python-nss-debugsourceUpgrade tomcat-admin-webappsUpgrade tomcat-javadocUpgrade jackson-module-jaxb-annotationsUpgrade xml-commons-apisUpgrade bea-stax-apiUpgrade tomcat-libUpgrade slf4jUpgrade stax-exUpgrade velocityUpgrade jakarta-commons-httpclientUpgrade jackson-jaxrs-providersUpgrade python3-nssUpgrade jackson-annotationsUpgrade python-nss-docUpgrade xsomUpgrade tomcat-servlet-3.0-apiUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-txw2Upgrade pki-servlet-4.0-apiUpgrade xerces-j2Upgrade glassfish-jaxb-runtimeUpgrade xml-commons-resolverUpgrade python3-nss-debuginfoUpgrade tomcat-jsvcUpgrade tomcat-docs-webappUpgrade glassfish-jaxb-coreUpgrade jackson-databindUpgrade javassist-javadocUpgrade xmlstreambufferUpgrade resteasyUpgrade tomcat-webappsUpgrade apache-commons-collectionsUpgrade glassfish-fastinfosetUpgrade apache-commons-langUpgrade xalan-j2Upgrade jackson-coreUpgrade tomcatUpgrade relaxngDatatypeUpgrade tomcat-jsp-2.2-api | Apr 1, 2019 | Oct 4, 2018 |
| Debian | — | Upgrade tomcat8Upgrade tomcat9Upgrade tomcat7 | Feb 19, 2019 | Oct 4, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade tomcat-webappsUpgrade tomcatUpgrade tomcat-admin-webappsUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-libUpgrade tomcat-el-2.2-api | Sep 25, 2019 | Oct 4, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade tomcat-webappsUpgrade tomcat-libUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-el-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcatUpgrade tomcat-servlet-3.0-api | May 30, 2019 | Oct 4, 2018 |
| Huawei Euleros 2_0_sp8 | — | Upgrade tomcat-servlet-4.0-apiUpgrade tomcat-el-3.0-apiUpgrade tomcat-admin-webappsUpgrade tomcatUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-lib | Jul 26, 2019 | Oct 4, 2018 |
| Oracle Missing Cpu Oct 2019 | — | Apply the October 2019 Critical Patch Update (CPU) for Oracle Database | Oct 17, 2019 | Oct 4, 2018 |
| Oracle Solaris | — | Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.34-11.4.3.0.1.4.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8 to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8 to version 8.5.34-11.4.3.0.1.4.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.34-11.4.3.0.1.4.0 on Solaris 11.4 | Nov 19, 2018 | Oct 4, 2018 |
| Oracle_linux | — | Upgrade tomcatUpgrade python-nss-docUpgrade glassfish-jaxb-runtimeUpgrade jackson-coreUpgrade tomcat-servlet-3.0-apiUpgrade relaxngDatatypeUpgrade pki-servlet-4.0-apiUpgrade tomcat-jsvcUpgrade slf4jUpgrade xml-commons-resolverUpgrade xsomUpgrade tomcat-docs-webappUpgrade jackson-module-jaxb-annotationsUpgrade glassfish-jaxb-txw2Upgrade javassist-javadocUpgrade xalan-j2Upgrade apache-commons-collectionsUpgrade jackson-annotationsUpgrade stax-exUpgrade bea-stax-apiUpgrade glassfish-jaxb-apiUpgrade glassfish-fastinfosetUpgrade slf4j-jdk14Upgrade resteasyUpgrade jackson-databindUpgrade jakarta-commons-httpclientUpgrade apache-commons-langUpgrade jackson-jaxrs-providersUpgrade xml-commons-apisUpgrade tomcat-jsp-2.2-apiUpgrade javassistUpgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade jackson-jaxrs-json-providerUpgrade python3-nssUpgrade velocityUpgrade xerces-j2Upgrade pki-servlet-containerUpgrade tomcat-el-2.2-apiUpgrade tomcat-javadocUpgrade xmlstreambufferUpgrade tomcat-webappsUpgrade glassfish-jaxb-core | Mar 14, 2019 | Oct 3, 2018 |
| Red Hat Jboss Eap | — | — | Sep 19, 2024 | Oct 3, 2018 |
| Redhat_linux | — | Upgrade pki-servlet-containerUpgrade xerces-j2Upgrade jakarta-commons-httpclientUpgrade resteasyUpgrade stax-exUpgrade glassfish-fastinfosetUpgrade xmlstreambufferUpgrade apache-commons-langUpgrade bea-stax-apiUpgrade jackson-databindUpgrade glassfish-jaxb-coreUpgrade velocityUpgrade python3-nssUpgrade jackson-jaxrs-providersUpgrade xml-commons-apisUpgrade glassfish-jaxb-apiUpgrade slf4j-jdk14Upgrade jackson-jaxrs-json-providerUpgrade javassistUpgrade glassfish-jaxb-txw2Upgrade jackson-annotationsUpgrade python3-nss-debuginfoUpgrade relaxngDatatypeUpgrade jackson-module-jaxb-annotationsUpgrade xsomUpgrade slf4jUpgrade glassfish-jaxb-runtimeUpgrade apache-commons-collectionsUpgrade python-nss-debugsourceUpgrade python-nss-docUpgrade pki-servlet-4.0-apiUpgrade javassist-javadocUpgrade xml-commons-resolverUpgrade xalan-j2Upgrade jackson-core | Mar 14, 2019 | Oct 4, 2018 |
| Rocky_linux | — | Upgrade python-nss-docUpgrade python3-nss-debuginfoUpgrade python3-nssUpgrade python-nss-debugsource | Mar 12, 2024 | Oct 4, 2018 |
| Suse | — | Upgrade tomcat-el-3_0-apiUpgrade virtualbox-develUpgrade tomcat6-webappsUpgrade virtualbox-host-kmp-defaultUpgrade virtualbox-websrvUpgrade tomcatUpgrade tomcat6-servlet-2_5-apiUpgrade tomcat-docs-webappUpgrade tomcat6-docs-webappUpgrade virtualbox-vncUpgrade tomcat-jsp-2_3-apiUpgrade tomcat6Upgrade virtualbox-guest-x11Upgrade tomcat6-admin-webappsUpgrade tomcat-servlet-3_0-apiUpgrade virtualbox-guest-sourceUpgrade tomcat-jsvcUpgrade tomcat-embedUpgrade tomcat6-libUpgrade python3-virtualboxUpgrade virtualbox-qtUpgrade tomcat-webappsUpgrade virtualbox-guest-desktop-iconsUpgrade virtualboxUpgrade tomcat-javadocUpgrade tomcat6-jsp-2_1-apiUpgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade virtualbox-guest-toolsUpgrade tomcat6-javadocUpgrade tomcat-el-2_2-apiUpgrade virtualbox-host-sourceUpgrade tomcat-servlet-3_1-apiUpgrade tomcat-jsp-2_2-apiUpgrade tomcat-servlet-4_0-apiUpgrade virtualbox-guest-kmp-default | Oct 20, 2018 | Oct 4, 2018 |
| Ubuntu | — | Upgrade libtomcat8-javaUpgrade libtomcat7-javaUpgrade tomcat7Upgrade tomcat8 | Oct 18, 2018 | Oct 4, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub