CVE-2018-11784

mediumpriority · attend · 61EPSS 0.977 · 100 %ileexploit · PoCDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

2 exploits · PoC

Likely / severe?

97.7% (100th) EPSS

CVSS 4.3 · medium

Is it mine?

89 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-26

When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.

cvss

Technical severity, 0–10. One row per scoring source.

4.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v2.04.3mediumAV:N/AC:M/Au:N/C:N/I:P/A:Nprimary · NVD / NIST USexploitability 8.6 · impact 2.9

v3.04.3mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:Nprimary · NVD / NIST USexploitability 2.8 · impact 1.4

v3.04.3mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:Nsecondary · OSV

v3.04.3mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:Hsecondary · CVSS-BT (t0sche)

v3.14.3mediumAV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:Nsecondary · FSTEC (BDU) RU

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-601USprimaryCWE-601USCWE-601USCWE-99US

exploits (2)

Public proof-of-concept and weaponised exploit code.

EDB-50118Apache Tomcat 9.0.0.M1 - Open RedirectPoC · exploit_db
Cappricio-Securities/CVE-2018-11784Apache Tomcat - Open RedirectPoC · poc_in_github

affected products (89)

Products and version ranges known to be affected.

Apache Tomcat <7.0.91all versionscert_bundDE
Apache Tomcat <8.5.34all versionscert_bundDE
Apache Tomcat <9.0.12all versionscert_bundDE
Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
HPE HP-UXall versionscert_bundDEcpe:/o:hp:hp-ux:-
IBM FlashSystem 840all versionscert_bundDEcpe:/a:ibm:flashsystem:840
IBM FlashSystem 900all versionscert_bundDEcpe:/a:ibm:flashsystem:900
Open Source CentOSall versionscert_bundDEcpe:/o:centos:centos:-
Oracle Linuxall versionscert_bundDEcpe:/o:oracle:linux:-
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
Ubuntu Linuxall versionscert_bundDEcpe:/o:canonical:ubuntu_linux:-
Apache Tomcat< 7.0.91cert_bundDE
Apache Tomcat< 8.5.34cert_bundDE
Apache Tomcat< 9.0.12cert_bundDE
Apache Software Foundation Apache Tomcat≤ 7.0.23 to 7.0.90enisa_euvdEU
Apache Software Foundation Apache Tomcat≤ 8.5.0 to 8.5.33enisa_euvdEU
Apache Software Foundation Apache Tomcat≤ 9.0.0.M1 to 9.0.11enisa_euvdEU
Apache Software Foundation Tomcat7.0.23 → 7.0.90fstec_bduRU
Apache Software Foundation Tomcat8.5.0 → 8.5.33fstec_bduRU

showing 20 of 89

advisories (6)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2023-0460Apache Tomcat: Schwachstelle ermöglicht Manipulation von DateienDeutsch2018-10-03csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache Tomcat ausnutzen, um Dateien zu manipulieren.
WID-SEC-W-2023-0531IBM SAN Volume Controller: Mehrere SchwachstellenDeutsch2019-02-25csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM SAN Volume Controller, IBM Storwize V3500, IBM Storwize V3700, IBM Storwize V5000 und IBM Storwize V7000 ausnutzen, um dadurch die Integrität, Vertraulichkeit und Verfügbarkeit zu gefährden.
WID-SEC-W-2024-0528Dell Data Protection Advisor: Mehrere SchwachstellenDeutsch2024-02-29csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Dell Data Protection Advisor ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Berechtigungen zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.
WID-SEC-W-2024-1682Oracle Retail Applications: Mehrere SchwachstellenDeutsch2019-04-16csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Oracle Retail Applications ausnutzen, um dadurch die Integrität, Vertraulichkeit und Verfügbarkeit zu gefährden.
WID-SEC-W-2025-1212Oracle Communications Applications: Mehrere SchwachstellenDeutsch2019-04-16csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Oracle Communications Applications ausnutzen, um dadurch die Integrität, Vertraulichkeit und Verfügbarkeit zu gefährden.
GHSA-5q99-f34m-67gcApache Tomcat Open Redirect vulnerability2018-10-17ghsa · osvUS
When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund osv NVD CVE.org MITRE

published 2018-10-04modified 2026-06-17

related (2,005)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2021-38000US	medium6.1OT critical	4.95% (92nd)	KEV	2021-11-23
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a malicious URL via a cr…
CVE-2012-0518US	medium4.7OT critical	4.69% (92nd)	KEV	2012-10-16
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown v…
CVE-2017-1000117US	high8.8	77.8% (100th)	Exploit	2017-10-05
A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine…
CVE-2025-4123US	medium6.1	97.1% (100th)	Exploit	2025-05-22
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website tha…
CVE-2019-10098US	medium6.1	74.0% (99th)	Exploit	2019-09-25
In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to a…

+2000 more

references (139)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan