Skip to content
OpenAdvisories
Medium USN-3787-1 1 CVE

tomcat7, tomcat8 vulnerability

Published Oct 10, 2018 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Tomcat incorrectly handled returning redirects to a
directory. A remote attacker could possibly use this issue with a specially
crafted URL to redirect to arbitrary URIs.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS tomcat7 7.0.52-1ubuntu0.16
Ubuntu · 16.04 LTS 16.04:LTS tomcat8 8.0.32-1ubuntu1.8

Vulnerabilities 1

  • Medium 4.3
    CVE-2018-11784 Public exploit Scanner template EPSS 98%

    Apache Tomcat Open Redirect vulnerability

    When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redi…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven

References

  • report
    https://ubuntu.com/security/CVE-2018-11784