Apache Tomcat - Open Redirect

🗓️ 21 Jun 2026 03:03:41Reported by ProjectDiscoveryType

nuclei🔗 github.com👁 133 Views

Apache Tomcat - Open Redirect CVE-2018-11784, medium severity, allows open redirection vulnerability, impacting user security leading to phishing attacks or malware download. Upgrade to version 9.0.12 or later

Reporter	Title	Published	Views	Family All 212
IBM Security Bulletins	Security Bulletin: A vulnerability in Apache Tomcat affects the IBM FlashSystem 840 and 900	18 Feb 202301:45	–	ibm
IBM Security Bulletins	Security Bulletin: Open Source Apache Tomcat vulnerabilities affect IBM Tivoli Application Dependency Discovery Manager (TADDM) (CVE-2018-11784)	27 Mar 201912:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM is vulnerable to Apache Tomcat Publicly disclosed vulnerability (CVE-2018-11784)	5 Mar 201918:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Cast Iron Solution is affected by Apache Tomcat vulnerabilities (CVE-2018-11784, CVE-2018-8034)	4 Feb 201913:05	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability in Apache Tomcat affects the IBM FlashSystem V840 and V9000	3 Jul 201917:00	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Integration Bus affected by Apache Tomcat (core only) vulnerability CVE-2018-11784	23 Mar 202020:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Business Intelligence has addressed multiple vulnerabilties	19 Dec 201921:01	–	ibm
IBM Security Bulletins	Security Bulletin: Resilient is vulnerable to Using Components with Known Vulnerabilities	19 Apr 202121:45	–	ibm
IBM Security Bulletins	Security Bulletin: Rational DOORS Web Access is affected by Apache Tomcat vulnerabilities	23 Oct 201817:25	–	ibm
IBM Security Bulletins	Security Bulletin: Rational Build Forge Security Advisory for Apache Tomcat and Apache HTTP Server (CVE-2018-11763; CVE-2018-11784)	15 Nov 201817:45	–	ibm

Source	Link
lists	www.lists.apache.org/thread.html/23134c9b5a23892a205dc140cdd8c9c0add233600f76b313dda6bd75@%3Cannounce.tomcat.apache.org%3E
nvd	www.nvd.nist.gov/vuln/detail/CVE-2018-11784
lists	www.lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html
lists	www.lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html
packetstormsecurity	www.packetstormsecurity.com/files/163456/Apache-Tomcat-9.0.0M1-Open-Redirect.html

id: CVE-2018-11784

info:
  name: Apache Tomcat - Open Redirect
  author: geeknik
  severity: medium
  description: |
    Apache Tomcat versions prior to 9.0.12, 8.5.34, and 7.0.91 are prone to an open-redirection vulnerability because it fails to properly sanitize user-supplied input.
  impact: |
    An attacker can redirect users to malicious websites, leading to phishing attacks or the download of malware.
  remediation: |
    Upgrade to Apache Tomcat version 9.0.12 or later, or apply the relevant patch provided by the Apache Software Foundation.
  reference:
    - https://lists.apache.org/thread.html/23134c9b5a23892a205dc140cdd8c9c0add233600f76b313dda6bd75@%3Cannounce.tomcat.apache.org%3E
    - https://nvd.nist.gov/vuln/detail/CVE-2018-11784
    - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html
    - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html
    - http://packetstormsecurity.com/files/163456/Apache-Tomcat-9.0.0M1-Open-Redirect.html
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
    cvss-score: 4.3
    cve-id: CVE-2018-11784
    cwe-id: CWE-601
    epss-score: 0.94494
    epss-percentile: 0.99843
    cpe: cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: apache
    product: tomcat
    shodan-query:
      - title:"Apache Tomcat"
      - http.title:"apache tomcat"
      - http.html:"apache tomcat"
      - cpe:"cpe:2.3:a:apache:tomcat"
    fofa-query:
      - body="apache tomcat"
      - title="apache tomcat"
    google-query: intitle:"apache tomcat"
  tags: cve,cve2018,packetstorm,tomcat,redirect,apache,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}//interact.sh"

    matchers-condition: and
    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*\.)?interact\.sh\/?(\/.*)?$'

      - type: status
        negative: true
        status:
          - 404
# digest: 4a0a00473045022100cd3fc10bb1d0a67192dc705375cdadc5e68d189c275603d4b1aaaff98e2de4a002203d0f6743ca63fc83bdfe144bc6edb1f97633c4edf1e1225b248fe35326f9a6b8:922c64590222798bb761d5b6d8e72950

04 Feb 2026 07:00Current

6.5Medium risk

Vulners AI Score6.5

CVSS 34.3

CVSS 24.3

EPSS0.94494