ZeroDay Findings
Sign inSign up

Findings

CVE-2018-11784

When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g.

Published Oct 4, 2018 · updated Oct 15, 2026 · apache tomcat

When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 4, 2018 · NIST NVD

    Detected

    When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.

  2. Oct 15, 2026 · NIST NVD

    Updated

    When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.

Affected

  • cpe apache/tomcatversion unspecified
  • cpe apache/tomcat9.0.0
  • cpe canonical/ubuntu linux14.04
  • cpe debian/debian linux8.0
  • cpe netapp/snap creator frameworkversion unspecified
  • cpe redhat/enterprise linux desktop7.0

Sources

  • CVE.orgVulnerability recordCVE-2018-11784

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2018-11784

    When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated

    nvd.nist.gov
  • Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/163456/Apache-Tomcat-9.0.0M1-Open-Redirect.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References

CVE-2018-11784 · ZeroDay Findings