CVE-2018-11784

CVE Details

Release Date:2018-10-04

Description


When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.

See more information about CVE-2018-11784 from MITRE CVE dictionary and NIST NVD


CVSS v3.0 metrics


NOTE: The following CVSS v3.0 metrics and score provided are preliminary and subject to review.

Base Score: 4.3 Base Metrics: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Access Vector: Network Attack Complexity: Low
Privileges Required: None User Interaction: Required
Scope: Unchanged Confidentiality Impact: None
Integrity Impact: Low Availability Impact: None

Errata information


PlatformErrataRelease Date
Oracle Linux version 7 (tomcat)ELSA-2019-04852019-03-13
Oracle Linux version 8 (apache-commons-collections)ELSA-2019-15292019-07-30
Oracle Linux version 8 (apache-commons-lang)ELSA-2019-15292019-07-30
Oracle Linux version 8 (bea-stax)ELSA-2019-15292019-07-30
Oracle Linux version 8 (glassfish-fastinfoset)ELSA-2019-15292019-07-30
Oracle Linux version 8 (glassfish-jaxb)ELSA-2019-15292019-07-30
Oracle Linux version 8 (glassfish-jaxb-api)ELSA-2019-15292019-07-30
Oracle Linux version 8 (jackson-annotations)ELSA-2019-15292019-07-30
Oracle Linux version 8 (jackson-core)ELSA-2019-15292019-07-30
Oracle Linux version 8 (jackson-databind)ELSA-2019-15292019-07-30
Oracle Linux version 8 (jackson-jaxrs-providers)ELSA-2019-15292019-07-30
Oracle Linux version 8 (jackson-module-jaxb-annotations)ELSA-2019-15292019-07-30
Oracle Linux version 8 (jakarta-commons-httpclient)ELSA-2019-15292019-07-30
Oracle Linux version 8 (javassist)ELSA-2019-15292019-07-30
Oracle Linux version 8 (pki-servlet-container)ELSA-2019-15292019-07-30
Oracle Linux version 8 (python-nss)ELSA-2019-15292019-07-30
Oracle Linux version 8 (relaxngDatatype)ELSA-2019-15292019-07-30
Oracle Linux version 8 (resteasy)ELSA-2019-15292019-07-30
Oracle Linux version 8 (slf4j)ELSA-2019-15292019-07-30
Oracle Linux version 8 (stax-ex)ELSA-2019-15292019-07-30
Oracle Linux version 8 (velocity)ELSA-2019-15292019-07-30
Oracle Linux version 8 (xalan-j2)ELSA-2019-15292019-07-30
Oracle Linux version 8 (xerces-j2)ELSA-2019-15292019-07-30
Oracle Linux version 8 (xml-commons-apis)ELSA-2019-15292019-07-30
Oracle Linux version 8 (xml-commons-resolver)ELSA-2019-15292019-07-30
Oracle Linux version 8 (xmlstreambuffer)ELSA-2019-15292019-07-30
Oracle Linux version 8 (xsom)ELSA-2019-15292019-07-30



This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team

software.hardware.complete