CVE-2018-11784
MediumPublic exploittomcat7 - security update
Published Jul 14, 2021 · Updated Oct 15, 2026 · Also known as DEBIAN-CVE-2018-11784, DLA-1544-1, DLA-1545-1, DSA-4596-1, GHSA-5q99-f34m-67gc, SUSE-SU-2018:3393-1, SUSE-SU-2018:3935-1, SUSE-SU-2018:3968-1, TR-21-0579, UBUNTU-CVE-2018-11784, USN-3787-1
Key Facts
Patch immediately- CVE-2018-11784 is a medium-severity vulnerability (CVSS 4.3 v3.1) affecting Tomcat (Apache), Snap Creator Framework (Netapp), Communications Application Session Controller (Oracle) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 98% probability of exploitation in the next 30 days.
- Fixed versions are available, including Tomcat <=7.0.90, Tomcat NA, Tomcat 0:7.0.76-9.el7_6.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
4.3
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
EPSS (30-day exploit likelihood)
98%
Higher than 99.9% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2018-11784 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.
Affected Products
367 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| TomcatApache | 9.0.0, 9.0.0-milestone1, 9.0.0-milestone10, 9.0.0-milestone11, 9.0.0-milestone12, 9.0.0-milestone13, 9.0.0-milestone14, 9.0.0-milestone15 | 7.0.90 |
| Snap Creator FrameworkNetapp | See advisory | n/a |
| Communications Application Session ControllerOracle | 3.7.1, 3.8.0 | n/a |
| Hospitality Guest AccessOracle | 4.2.0, 4.2.1 | n/a |
| Instantis EnterprisetrackOracle | 17.1, 17.2, 17.3 | n/a |
Patched Releases
Tomcat
<=7.0.90, NA, 0:7.0.76-9.el7_6, 7.0.76-9.amzn2, 7.0.76-9.el7_6, 7.0.90-7.23.1, 8.0.53-10.35.1, 8.0.53-18.1, 8.0.53-29.16.2, 9.0.12-3.8.3, 9.0.12-lp150.2.6.1, 9.0.36-8.4
apache-commons-collections
3.2.2-10.module_el8.5.0+2577+9e95fe00, 3.2.2-10.module+el8.0.0+5231+3e842911, 3.2.2-10.module+el8.3.0+53+ea062990
apache-commons-lang
2.6-21.module_el8.5.0+150+5f0dbea0, 2.6-21.module+el8.0.0+5231+3e842911, 2.6-21.module+el8.3.0+53+ea062990
tomcat-webapps
NA, 7.0.76-9.amzn2, 7.0.76-9.el7_6, 7.0.90-7.23.1, 8.0.53-10.35.1, 8.0.53-18.1, 8.0.53-29.16.2, 9.0.12-3.8.3, 9.0.12-lp150.2.6.1, 9.0.36-8.4
bea-stax
1.2.0-16.module_el8.5.0+150+5f0dbea0, 1.2.0-16.module+el8.3.0+53+ea062990
bea-stax-api
1.2.0-16.module+el8.0.0+5231+3e842911
glassfish-fastinfoset
1.2.13-9.module_el8.5.0+150+5f0dbea0, 1.2.13-9.module+el8.0.0+5231+3e842911, 1.2.13-9.module+el8.3.0+53+ea062990
glassfish-jaxb
2.2.11-11.module_el8.5.0+2577+9e95fe00, 2.2.11-11.module+el8.3.0+53+ea062990
glassfish-jaxb-api
2.2.12-8.module_el8.5.0+2577+9e95fe00, 2.2.12-8.module+el8.0.0+5231+3e842911, 2.2.12-8.module+el8.3.0+53+ea062990
glassfish-jaxb-core
2.2.11-11.module+el8.0.0+5231+3e842911
glassfish-jaxb-runtime
2.2.11-11.module+el8.0.0+5231+3e842911
glassfish-jaxb-txw2
2.2.11-11.module+el8.0.0+5231+3e842911
jackson-annotations
2.9.8-1.module+el8.0.0+5231+3e842911
jackson-core
2.9.8-1.module+el8.0.0+5231+3e842911
jackson-databind
2.9.8-1.module+el8.0.0+5231+3e842911
jackson-jaxrs-json-provider
2.9.8-1.module+el8.0.0+5231+3e842911
jackson-jaxrs-providers
2.9.8-1.module+el8.0.0+5231+3e842911
jackson-module-jaxb-annotations
2.7.6-4.module_el8.5.0+150+5f0dbea0, 2.7.6-4.module+el8.0.0+5231+3e842911, 2.7.6-4.module+el8.3.0+53+ea062990
jakarta-commons-httpclient
1:3.1-28.module_el8.5.0+2577+9e95fe00, 1:3.1-28.module+el8.0.0+5231+3e842911, 1:3.1-28.module+el8.3.0+53+ea062990
javassist
3.18.1-8.module_el8.5.0+150+5f0dbea0, 3.18.1-8.module+el8.0.0+5231+3e842911, 3.18.1-8.module+el8.3.0+53+ea062990
javassist-javadoc
3.18.1-8.module+el8.0.0+5231+3e842911
jws5-tomcat
0:9.0.7-12.redhat_12.1.el6jws, 0:9.0.7-12.redhat_12.1.el7jws
org.apache.tomcat.embed:tomcat-embed-core
7.0.91, 8.5.34, 9.0.12
pki-deps:10.6
8000020190524054914.55190bc5
pki-servlet-4.0-api
1:9.0.7-14.module+el8.0.0+5231+3e842911
Timeline
Publicly disclosed
Jul 14, 2021
Last updated
Oct 15, 2026
Weakness Type
- CWE-99 Improper Control of Resource Identifiers ('Resource Injection')
- CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
References
- advisoryRHSA-2018:2867
- advisoryRHSA-2018:2868
- advisoryRHSA-2019:0130
- advisoryRHSA-2019:0131
- advisoryRHSA-2019:0485
FAQ
Common Questions.
When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g.
Affected: Tomcat (Apache) versions 9.0.0, 9.0.0-milestone1, 9.0.0-milestone10, 9.0.0-milestone11, 9.0.0-milestone12, 9.0.0-milestone13, 9.0.0-milestone14, 9.0.0-milestone15; Snap Creator Framework (Netapp); Communications Application Session Controller (Oracle) versions 3.7.1, 3.8.0, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Tomcat <=7.0.90, Tomcat NA, Tomcat 0:7.0.76-9.el7_6.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2018-11784 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo