When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.0 Base Score: 4.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade glassfish-jaxb-txw2Upgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-coreUpgrade xalan-j2Upgrade javassist-javadocUpgrade apache-commons-collectionsUpgrade glassfish-fastinfosetUpgrade xerces-j2Upgrade xmlstreambufferUpgrade relaxngDatatypeUpgrade xsomUpgrade javassistUpgrade xml-commons-resolverUpgrade bea-stax-apiUpgrade velocityUpgrade glassfish-jaxb-apiUpgrade xml-commons-apisUpgrade slf4jUpgrade slf4j-jdk14Upgrade apache-commons-langUpgrade python3-nssUpgrade jackson-module-jaxb-annotationsUpgrade python-nss-docUpgrade stax-exUpgrade glassfish-jaxb-runtime | May 13, 2022 | Oct 4, 2018 |
| Amazon Linux Ami 2 | — | Upgrade tomcat-admin-webappsUpgrade tomcat-el-2.2-apiUpgrade tomcat-libUpgrade tomcatUpgrade tomcat-docs-webappUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-jsvcUpgrade tomcat-webappsUpgrade tomcat-javadocUpgrade tomcat-servlet-3.0-api | Apr 27, 2020 | Oct 4, 2018 |
| Amazon_linux | — | Upgrade tomcat7Upgrade tomcat8 | Nov 8, 2018 | Oct 4, 2018 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 8.5.34Upgrade Apache Tomcat to 7.0.91Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 9.0.12 | Oct 4, 2018 | Oct 4, 2018 |
| Centos_linux | — | Upgrade slf4j-jdk14Upgrade tomcat-el-2.2-apiUpgrade tomcat-libUpgrade velocityUpgrade jackson-module-jaxb-annotationsUpgrade javassistUpgrade tomcat-javadocUpgrade python-nss-debugsourceUpgrade pki-servlet-containerUpgrade jakarta-commons-httpclientUpgrade tomcat-admin-webappsUpgrade slf4jUpgrade stax-exUpgrade jackson-jaxrs-providersUpgrade bea-stax-apiUpgrade python3-nssUpgrade xml-commons-apisUpgrade python-nss-docUpgrade jackson-annotationsUpgrade glassfish-jaxb-apiUpgrade apache-commons-langUpgrade xerces-j2Upgrade jackson-jaxrs-json-providerUpgrade pki-servlet-4.0-apiUpgrade glassfish-jaxb-txw2Upgrade tomcat-servlet-3.0-apiUpgrade python3-nss-debuginfoUpgrade glassfish-jaxb-runtimeUpgrade tomcat-jsvcUpgrade xsomUpgrade xmlstreambufferUpgrade apache-commons-collectionsUpgrade jackson-coreUpgrade glassfish-jaxb-coreUpgrade tomcatUpgrade xalan-j2Upgrade xml-commons-resolverUpgrade glassfish-fastinfosetUpgrade tomcat-jsp-2.2-apiUpgrade javassist-javadocUpgrade jackson-databindUpgrade resteasyUpgrade tomcat-webappsUpgrade tomcat-docs-webappUpgrade relaxngDatatype | Apr 1, 2019 | Oct 4, 2018 |
| Debian | — | Upgrade tomcat8Upgrade tomcat7Upgrade tomcat9 | Feb 19, 2019 | Oct 4, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade tomcat-webappsUpgrade tomcatUpgrade tomcat-admin-webappsUpgrade tomcat-el-2.2-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-libUpgrade tomcat-servlet-3.0-api | Sep 25, 2019 | Oct 4, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade tomcat-webappsUpgrade tomcat-libUpgrade tomcatUpgrade tomcat-el-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-servlet-3.0-api | May 30, 2019 | Oct 4, 2018 |
| Huawei Euleros 2_0_sp8 | — | Upgrade tomcat-jsp-2.3-apiUpgrade tomcat-libUpgrade tomcatUpgrade tomcat-el-3.0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-4.0-api | Jul 26, 2019 | Oct 4, 2018 |
| Oracle Missing Cpu Oct 2019 | — | Apply the October 2019 Critical Patch Update (CPU) for Oracle Database | Oct 17, 2019 | Oct 4, 2018 |
| Oracle Solaris | — | Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.34-11.4.3.0.1.4.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.34-11.4.3.0.1.4.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8 to version 8.5.34-11.4.3.0.1.4.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8 to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3 | Nov 19, 2018 | Oct 4, 2018 |
| Oracle_linux | — | Upgrade tomcat-javadocUpgrade pki-servlet-containerUpgrade jackson-jaxrs-providersUpgrade xmlstreambufferUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-libUpgrade tomcat-el-2.2-apiUpgrade stax-exUpgrade jakarta-commons-httpclientUpgrade xerces-j2Upgrade glassfish-fastinfosetUpgrade jackson-databindUpgrade tomcat-admin-webappsUpgrade apache-commons-langUpgrade jackson-jaxrs-json-providerUpgrade xml-commons-apisUpgrade resteasyUpgrade tomcat-webappsUpgrade bea-stax-apiUpgrade python3-nssUpgrade velocityUpgrade javassistUpgrade glassfish-jaxb-apiUpgrade slf4j-jdk14Upgrade glassfish-jaxb-coreUpgrade relaxngDatatypeUpgrade slf4jUpgrade tomcat-jsvcUpgrade xalan-j2Upgrade glassfish-jaxb-txw2Upgrade tomcat-docs-webappUpgrade jackson-module-jaxb-annotationsUpgrade glassfish-jaxb-runtimeUpgrade jackson-coreUpgrade tomcat-servlet-3.0-apiUpgrade xml-commons-resolverUpgrade javassist-javadocUpgrade jackson-annotationsUpgrade tomcatUpgrade apache-commons-collectionsUpgrade xsomUpgrade python-nss-docUpgrade pki-servlet-4.0-api | Mar 14, 2019 | Oct 3, 2018 |
| Red Hat Jboss Eap | — | — | Sep 19, 2024 | Oct 3, 2018 |
| Redhat_linux | — | Upgrade glassfish-jaxb-txw2Upgrade slf4jUpgrade jackson-annotationsUpgrade javassist-javadocUpgrade jackson-module-jaxb-annotationsUpgrade glassfish-jaxb-runtimeUpgrade apache-commons-collectionsUpgrade xsomUpgrade xml-commons-resolverUpgrade python-nss-debugsourceUpgrade relaxngDatatypeUpgrade pki-servlet-4.0-apiUpgrade python3-nss-debuginfoUpgrade xalan-j2Upgrade jackson-coreUpgrade python-nss-docUpgrade xmlstreambufferUpgrade glassfish-jaxb-apiUpgrade stax-exUpgrade javassistUpgrade xml-commons-apisUpgrade slf4j-jdk14Upgrade bea-stax-apiUpgrade xerces-j2Upgrade jackson-jaxrs-json-providerUpgrade resteasyUpgrade jackson-jaxrs-providersUpgrade velocityUpgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-coreUpgrade python3-nssUpgrade jackson-databindUpgrade glassfish-fastinfosetUpgrade apache-commons-langUpgrade pki-servlet-container | Mar 14, 2019 | Oct 4, 2018 |
| Rocky_linux | — | Upgrade python3-nss-debuginfoUpgrade python-nss-docUpgrade python3-nssUpgrade python-nss-debugsource | Mar 12, 2024 | Oct 4, 2018 |
| Suse | — | Upgrade tomcatUpgrade tomcat-embedUpgrade tomcat-servlet-3_0-apiUpgrade tomcat6-admin-webappsUpgrade tomcat-jsvcUpgrade virtualbox-guest-sourceUpgrade virtualbox-vncUpgrade tomcat-el-3_0-apiUpgrade tomcat6Upgrade tomcat6-docs-webappUpgrade virtualbox-develUpgrade virtualbox-guest-x11Upgrade virtualbox-websrvUpgrade tomcat6-webappsUpgrade virtualbox-host-kmp-defaultUpgrade tomcat6-servlet-2_5-apiUpgrade tomcat-docs-webappUpgrade tomcat-jsp-2_3-apiUpgrade virtualboxUpgrade tomcat-el-2_2-apiUpgrade tomcat-servlet-3_1-apiUpgrade virtualbox-guest-kmp-defaultUpgrade tomcat6-libUpgrade tomcat6-javadocUpgrade virtualbox-qtUpgrade virtualbox-host-sourceUpgrade tomcat6-jsp-2_1-apiUpgrade tomcat-webappsUpgrade tomcat-jsp-2_2-apiUpgrade tomcat-javadocUpgrade python3-virtualboxUpgrade virtualbox-guest-toolsUpgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade virtualbox-guest-desktop-iconsUpgrade tomcat-servlet-4_0-api | Oct 20, 2018 | Oct 4, 2018 |
| Ubuntu | — | Upgrade tomcat8Upgrade libtomcat7-javaUpgrade libtomcat8-javaUpgrade tomcat7 | Oct 18, 2018 | Oct 4, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub