CVE-2018-11784 Public exploit EPSS 97.7%

When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a…

Apache Software Foundation · Apache Tomcat

Summary

The default servlet in Apache Software Foundation's Apache Tomcat, in the affected 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 branches, is flawed in how it generates directory redirects.

Official description · CVE.org

When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.

Breakdown

25.0 / 100

Exploited: Not confirmed
Reports: 0
Tactics: 0/15

Public exploit code (Exploit-DB) appeared 3 years after disclosure. No confirmed exploitation is recorded.

Disclosed4 Oct 2018day 0
Public exploit codeExploit-DB13 Jul 2021+3 yrs

7 fixes in tomcat-embed-core over 12 months. The latest fix listed for tomcat-embed-core is 9.0.17.

Fixes in tomcat-embed-coreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

9.0.9CVE-2018-801416 May 2018
9.0.10CVE-2018-80341 Aug 2018
9.0.10CVE-2018-80372 Aug 2018
9.0.12CVE-2018-117844 Oct 2018
9.0.16CVE-2019-019910 Apr 2019
9.0.17CVE-2019-023215 Apr 2019
9.0.17CVE-2019-022128 May 2019Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.apache.tomcat.embed:tomcat-embed-core.

Mavenorg.apache.tomcat.embed:tomcat-embed-coreGHSA-5q99-f34m-67gc

Upgrade to 9.0.109 or later

Fixes this CVE and 12 other known vulnerabilities in this package (CVE-2017-12617, CVE-2019-0199, +10).

Set the version to 9.0.109 or later in your pom.xml or build.gradle.

First fixed in 9.0.12 for CVE-2018-11784.

Affected versions, by release line

If you run	Upgrade to
9.0.0 up to 9.0.12	9.0.109first fix for this CVE: 9.0.12
8.5.0 up to 8.5.34 Still affected on this line by CVE-2025-24813 (no fix published); CVE-2025-31650 (no fix published); CVE-2025-55752 (no fix published).	8.5.94first fix for this CVE: 8.5.34
7.0.23 up to 7.0.91	7.0.104first fix for this CVE: 7.0.91

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

39 links, grouped by NVD tag

x_refsource_CONFIRM 3

oracle.com/technetwork/security-advisory/cpujan2019-5072801.html security.netapp.com/advisory/ntap-20181014-0002/kc.mcafee.com/corporate/index?page=content&id=SB10284

mailing-list 20

lists.apache.org/thread.html/23134c9b5a23892a205dc140cdd8c9c0add233600f76b313dda6bd75%40%3Cannounce.tomcat.apache.org%3E lists.debian.org/debian-lts-announce/2018/10/msg00005.html lists.debian.org/debian-lts-announce/2018/10/msg00006.html lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E

Show 12 moreShow fewer

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2018-0512

Apache Tomcat 9.0.0.M1 - Open RedirectEDB-50118 · webapps · multiple · 2021-07-13

, 30 Oct 2026

97.7%Top 0.1%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.9%).

No CVSS score published.

Priority factorsFormula

In a KEV catalognot listed 0.0/35

Recent KEV listingnot listed 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9990 20.0/20

Threat reports0 reports 0.0/10

Public exploit code1 Exploit-DB entry; 1 NVD exploit link; 1 PoC-in-GitHub repo; 1 nuclei template 5.0/5

Mentioned in OTX pulses0 pulses 0.0/3

CVSS base scoreno CVSS 0.0/7

End-of-life productsupported or unknown 0.0

Total25.0

Record

Published: 4 Oct 2018
Modified: 15 Oct 2026
: None assigned
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Fixes in tomcat-embed-coreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques