CVE-2018-11784

Published: Oct 4, 2018Modified: Nov 21, 2024

4.3

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.

Affected (53)

Products: Apache: Tomcat · Debian: Debian Linux · Canonical: Ubuntu Linux · +3 more

Show all products

1 product

1 product

1 product

1 product

Snap Creator Framework

Redhat

6 products

Enterprise Linux Desktop

Enterprise Linux Server

Enterprise Linux Server Aus

Enterprise Linux Server Eus

Enterprise Linux Server Tus

Enterprise Linux Workstation

Oracle

5 products

Communications Application Session Controller

Hospitality Guest Access

Instantis Enterprisetrack

Retail Order Broker

Secure Global Desktop

Configuration A

31 vulnerable

Vulnerable Software	Affected Versions
Apache Tomcat	From 7.0.23 to 7.0.90
Apache Tomcat	From 8.5.0 to 8.5.33
Apache Tomcat	From 9.0.1 to 9.0.11
Apache Tomcat	Version 9.0.0
Apache Tomcat	Version 9.0.0 milestone10
Apache Tomcat	Version 9.0.0 milestone11
Apache Tomcat	Version 9.0.0 milestone12
Apache Tomcat	Version 9.0.0 milestone13
Apache Tomcat	Version 9.0.0 milestone14
Apache Tomcat	Version 9.0.0 milestone15
Apache Tomcat	Version 9.0.0 milestone16
Apache Tomcat	Version 9.0.0 milestone17
Apache Tomcat	Version 9.0.0 milestone18
Apache Tomcat	Version 9.0.0 milestone19
Apache Tomcat	Version 9.0.0 milestone1
Apache Tomcat	Version 9.0.0 milestone20
Apache Tomcat	Version 9.0.0 milestone21
Apache Tomcat	Version 9.0.0 milestone22
Apache Tomcat	Version 9.0.0 milestone23
Apache Tomcat	Version 9.0.0 milestone24
Apache Tomcat	Version 9.0.0 milestone25
Apache Tomcat	Version 9.0.0 milestone26
Apache Tomcat	Version 9.0.0 milestone27
Apache Tomcat	Version 9.0.0 milestone2
Apache Tomcat	Version 9.0.0 milestone3
Apache Tomcat	Version 9.0.0 milestone4
Apache Tomcat	Version 9.0.0 milestone5
Apache Tomcat	Version 9.0.0 milestone6
Apache Tomcat	Version 9.0.0 milestone7
Apache Tomcat	Version 9.0.0 milestone8
Apache Tomcat	Version 9.0.0 milestone9

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 16.04

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Netapp Snap Creator Framework	All versions

Configuration E

7 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 7.0
Redhat Enterprise Linux Server	Version 7.0
Redhat Enterprise Linux Server	Version 7.6
Redhat Enterprise Linux Server Aus	Version 7.6
Redhat Enterprise Linux Server Eus	Version 7.6
Redhat Enterprise Linux Server Tus	Version 7.6
Redhat Enterprise Linux Workstation	Version 7.0

Configuration F

11 vulnerable

Vulnerable Software	Affected Versions
Oracle Communications Application Session Controller	Version 3.7.1
Oracle Communications Application Session Controller	Version 3.8.0
Oracle Hospitality Guest Access	Version 4.2.0
Oracle Hospitality Guest Access	Version 4.2.1
Oracle Instantis Enterprisetrack	Version 17.1
Oracle Instantis Enterprisetrack	Version 17.2
Oracle Instantis Enterprisetrack	Version 17.3
Oracle Retail Order Broker	Version 15.0
Oracle Retail Order Broker	Version 5.1
Oracle Retail Order Broker	Version 5.2
Oracle Secure Global Desktop	Version 5.4

Related CWEs

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

References (78)

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html

Source: security@apache.org

http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html

Source: security@apache.org

http://packetstormsecurity.com/files/163456/Apache-Tomcat-9.0.0M1-Open-Redirect.html

Source: security@apache.org

http://www.securityfocus.com/bid/105524

Source: security@apache.org

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2019:0130

Source: security@apache.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:0131

Source: security@apache.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:0485

Source: security@apache.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:1529

Source: security@apache.org

https://kc.mcafee.com/corporate/index?page=content&id=SB10284

Source: security@apache.org

https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/23134c9b5a23892a205dc140cdd8c9c0add233600f76b313dda6bd75%40%3Cannounce.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.debian.org/debian-lts-announce/2018/10/msg00005.html

Source: security@apache.org

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2018/10/msg00006.html

Source: security@apache.org

Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZ4PX4B3QTKRM35VJAVIEOPZAF76RPBP/

Source: security@apache.org

https://seclists.org/bugtraq/2019/Dec/43

Source: security@apache.org

https://security.netapp.com/advisory/ntap-20181014-0002/

Source: security@apache.org

Third Party Advisory

https://usn.ubuntu.com/3787-1/

Source: security@apache.org

Third Party Advisory

https://www.debian.org/security/2019/dsa-4596

Source: security@apache.org

https://www.oracle.com/security-alerts/cpuapr2020.html

Source: security@apache.org

https://www.oracle.com/security-alerts/cpujan2020.html

Source: security@apache.org

https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

Source: security@apache.org

https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

Source: security@apache.org

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html