Apache Tomcat Open Redirect vulnerability
Moderate severity
GitHub Reviewed
Published
Oct 17, 2018
to the GitHub Advisory Database
•
Updated Feb 22, 2024
Package
Affected versions
>= 8.5.0, < 8.5.34
>= 7.0.23, < 7.0.91
>= 9.0.0, < 9.0.12
Patched versions
8.5.34
7.0.91
9.0.12
Description
Published by the National Vulnerability Database
Oct 4, 2018
Published to the GitHub Advisory Database
Oct 17, 2018
Reviewed
Jun 16, 2020
Last updated
Feb 22, 2024
Credits
-
sunSUNQ Analyst
When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.
References