When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.0 Base Score: 4.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade apache-commons-collectionsUpgrade glassfish-fastinfosetUpgrade relaxngDatatypeUpgrade xmlstreambufferUpgrade xalan-j2Upgrade xsomUpgrade glassfish-jaxb-coreUpgrade javassistUpgrade xerces-j2Upgrade xml-commons-resolverUpgrade glassfish-jaxb-txw2Upgrade jakarta-commons-httpclientUpgrade javassist-javadocUpgrade slf4jUpgrade velocityUpgrade glassfish-jaxb-apiUpgrade apache-commons-langUpgrade bea-stax-apiUpgrade jackson-module-jaxb-annotationsUpgrade stax-exUpgrade glassfish-jaxb-runtimeUpgrade xml-commons-apisUpgrade python-nss-docUpgrade python3-nssUpgrade slf4j-jdk14 | May 13, 2022 | Oct 4, 2018 |
| Amazon Linux Ami 2 | — | Upgrade tomcat-jsp-2.2-apiUpgrade tomcat-docs-webappUpgrade tomcat-servlet-3.0-apiUpgrade tomcatUpgrade tomcat-webappsUpgrade tomcat-javadocUpgrade tomcat-jsvcUpgrade tomcat-el-2.2-apiUpgrade tomcat-libUpgrade tomcat-admin-webapps | Apr 27, 2020 | Oct 4, 2018 |
| Amazon_linux | — | Upgrade tomcat7Upgrade tomcat8 | Nov 8, 2018 | Oct 4, 2018 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 8.5.34Upgrade Apache Tomcat to 7.0.91Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 9.0.12 | Oct 4, 2018 | Oct 4, 2018 |
| Centos_linux | — | Upgrade relaxngDatatypeUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-servlet-3.0-apiUpgrade jackson-coreUpgrade xalan-j2Upgrade glassfish-fastinfosetUpgrade apache-commons-langUpgrade xml-commons-resolverUpgrade tomcatUpgrade glassfish-jaxb-coreUpgrade tomcat-webappsUpgrade apache-commons-collectionsUpgrade jackson-databindUpgrade glassfish-jaxb-runtimeUpgrade xmlstreambufferUpgrade tomcat-jsvcUpgrade pki-servlet-4.0-apiUpgrade glassfish-jaxb-txw2Upgrade python3-nss-debuginfoUpgrade tomcat-docs-webappUpgrade javassist-javadocUpgrade resteasyUpgrade xsomUpgrade jackson-jaxrs-json-providerUpgrade xerces-j2Upgrade pki-servlet-containerUpgrade python3-nssUpgrade jackson-jaxrs-providersUpgrade tomcat-admin-webappsUpgrade xml-commons-apisUpgrade glassfish-jaxb-apiUpgrade python-nss-docUpgrade jackson-annotationsUpgrade javassistUpgrade slf4jUpgrade tomcat-libUpgrade stax-exUpgrade jakarta-commons-httpclientUpgrade jackson-module-jaxb-annotationsUpgrade velocityUpgrade slf4j-jdk14Upgrade tomcat-javadocUpgrade tomcat-el-2.2-apiUpgrade bea-stax-apiUpgrade python-nss-debugsource | Apr 1, 2019 | Oct 4, 2018 |
| Debian | — | Upgrade tomcat8Upgrade tomcat9Upgrade tomcat7 | Feb 19, 2019 | Oct 4, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade tomcatUpgrade tomcat-admin-webappsUpgrade tomcat-webappsUpgrade tomcat-el-2.2-apiUpgrade tomcat-libUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-servlet-3.0-api | Sep 25, 2019 | Oct 4, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade tomcat-webappsUpgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade tomcat-el-2.2-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcat | May 30, 2019 | Oct 4, 2018 |
| Huawei Euleros 2_0_sp8 | — | Upgrade tomcat-libUpgrade tomcat-jsp-2.3-apiUpgrade tomcatUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-el-3.0-api | Jul 26, 2019 | Oct 4, 2018 |
| Oracle Missing Cpu Oct 2019 | — | Apply the October 2019 Critical Patch Update (CPU) for Oracle Database | Oct 17, 2019 | Oct 4, 2018 |
| Oracle Solaris | — | Upgrade web/java-servlet/tomcat-8 to version 8.5.34-11.4.3.0.1.4.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.34-11.4.3.0.1.4.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8 to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.34-11.4.3.0.1.4.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3 | Nov 19, 2018 | Oct 4, 2018 |
| Oracle_linux | — | Upgrade jackson-annotationsUpgrade javassist-javadocUpgrade xalan-j2Upgrade glassfish-jaxb-txw2Upgrade xsomUpgrade xml-commons-resolverUpgrade glassfish-jaxb-runtimeUpgrade relaxngDatatypeUpgrade tomcatUpgrade jackson-module-jaxb-annotationsUpgrade python-nss-docUpgrade tomcat-docs-webappUpgrade tomcat-jsvcUpgrade pki-servlet-4.0-apiUpgrade apache-commons-collectionsUpgrade slf4jUpgrade tomcat-servlet-3.0-apiUpgrade jackson-coreUpgrade tomcat-admin-webappsUpgrade jackson-databindUpgrade javassistUpgrade apache-commons-langUpgrade stax-exUpgrade jakarta-commons-httpclientUpgrade xerces-j2Upgrade velocityUpgrade tomcat-libUpgrade tomcat-javadocUpgrade tomcat-jsp-2.2-apiUpgrade jackson-jaxrs-providersUpgrade slf4j-jdk14Upgrade glassfish-jaxb-apiUpgrade glassfish-fastinfosetUpgrade pki-servlet-containerUpgrade resteasyUpgrade xml-commons-apisUpgrade xmlstreambufferUpgrade tomcat-webappsUpgrade python3-nssUpgrade bea-stax-apiUpgrade jackson-jaxrs-json-providerUpgrade tomcat-el-2.2-apiUpgrade glassfish-jaxb-core | Mar 14, 2019 | Oct 3, 2018 |
| Red Hat Jboss Eap | — | — | Sep 19, 2024 | Oct 3, 2018 |
| Redhat_linux | — | Upgrade glassfish-jaxb-runtimeUpgrade slf4jUpgrade javassist-javadocUpgrade glassfish-jaxb-txw2Upgrade pki-servlet-4.0-apiUpgrade python-nss-docUpgrade xml-commons-resolverUpgrade xalan-j2Upgrade python-nss-debugsourceUpgrade xsomUpgrade python3-nss-debuginfoUpgrade apache-commons-collectionsUpgrade jackson-module-jaxb-annotationsUpgrade relaxngDatatypeUpgrade jackson-coreUpgrade jackson-annotationsUpgrade velocityUpgrade xmlstreambufferUpgrade glassfish-jaxb-coreUpgrade python3-nssUpgrade jackson-jaxrs-json-providerUpgrade bea-stax-apiUpgrade stax-exUpgrade jakarta-commons-httpclientUpgrade resteasyUpgrade jackson-databindUpgrade glassfish-fastinfosetUpgrade xerces-j2Upgrade pki-servlet-containerUpgrade apache-commons-langUpgrade slf4j-jdk14Upgrade jackson-jaxrs-providersUpgrade xml-commons-apisUpgrade glassfish-jaxb-apiUpgrade javassist | Mar 14, 2019 | Oct 4, 2018 |
| Rocky_linux | — | Upgrade python3-nss-debuginfoUpgrade python-nss-docUpgrade python-nss-debugsourceUpgrade python3-nss | Mar 12, 2024 | Oct 4, 2018 |
| Suse | — | Upgrade virtualbox-qtUpgrade tomcat-jsp-2_2-apiUpgrade tomcat6-javadocUpgrade tomcat-webappsUpgrade tomcat-servlet-3_1-apiUpgrade tomcat-servlet-4_0-apiUpgrade python3-virtualboxUpgrade tomcat-admin-webappsUpgrade virtualbox-guest-toolsUpgrade virtualbox-guest-kmp-defaultUpgrade tomcat-el-2_2-apiUpgrade tomcat-libUpgrade virtualboxUpgrade tomcat6-libUpgrade virtualbox-guest-desktop-iconsUpgrade tomcat-javadocUpgrade tomcat6-jsp-2_1-apiUpgrade virtualbox-host-sourceUpgrade virtualbox-develUpgrade tomcat-docs-webappUpgrade tomcat-jsvcUpgrade virtualbox-websrvUpgrade tomcat6-admin-webappsUpgrade tomcat-el-3_0-apiUpgrade virtualbox-vncUpgrade tomcat6Upgrade tomcat6-webappsUpgrade virtualbox-guest-x11Upgrade virtualbox-host-kmp-defaultUpgrade tomcat6-servlet-2_5-apiUpgrade virtualbox-guest-sourceUpgrade tomcatUpgrade tomcat-jsp-2_3-apiUpgrade tomcat6-docs-webappUpgrade tomcat-servlet-3_0-apiUpgrade tomcat-embed | Oct 20, 2018 | Oct 4, 2018 |
| Ubuntu | — | Upgrade tomcat8Upgrade tomcat7Upgrade libtomcat7-javaUpgrade libtomcat8-java | Oct 18, 2018 | Oct 4, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub