CVE-2018-11784Medium· 4.3▾ TwilightPoC availableWhen the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 23.7 · likelihood 19.5 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 3 sources. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
98%
Exploit-DB · 1 GitHub repo · Nuclei ×1 (last check)
When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.
tomcat >= 7.0.23, <= 7.0.90tomcat >= 8.5.0, <= 8.5.33tomcat >= 9.0.1, <= 9.0.11tomcat = 9.0.0debian_linux = 8.0ubuntu_linux = 14.04ubuntu_linux = 16.04snap_creator_frameworkenterprise_linux_desktop = 7.0enterprise_linux_server = 7.0enterprise_linux_server = 7.6enterprise_linux_server_aus = 7.6enterprise_linux_server_eus = 7.6enterprise_linux_server_tus = 7.6enterprise_linux_workstation = 7.0communications_application_session_controller = 3.7.1communications_application_session_controller = 3.8.0hospitality_guest_access = 4.2.0hospitality_guest_access = 4.2.1instantis_enterprisetrack = 17.1instantis_enterprisetrack = 17.2instantis_enterprisetrack = 17.3retail_order_broker = 5.1retail_order_broker = 5.2retail_order_broker = 15.0secure_global_desktop = 5.4Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2018-1304Medium· 5.9The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constr…
CVE-2018-1305Medium· 6.5Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded
CVE-2018-8014Critical· 9.8The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins
CVE-2016-0763Medium· 6.3The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are a…
CVE-2016-6794Medium· 5.3When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager
CVE-2017-12616High· 7.5When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.