When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to /foo/ when the user requested /foo) a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Name | Vendor | Start Version | End Version |
---|---|---|---|
Tomcat | Apache | 7.0.23 (including) | 7.0.90 (including) |
Tomcat | Apache | 8.5.0 (including) | 8.5.33 (including) |
Tomcat | Apache | 9.0.1 (including) | 9.0.11 (including) |
Tomcat | Apache | 9.0.0 (including) | 9.0.0 (including) |
Tomcat | Apache | 9.0.0-milestone1 (including) | 9.0.0-milestone1 (including) |
Tomcat | Apache | 9.0.0-milestone10 (including) | 9.0.0-milestone10 (including) |
Tomcat | Apache | 9.0.0-milestone11 (including) | 9.0.0-milestone11 (including) |
Tomcat | Apache | 9.0.0-milestone12 (including) | 9.0.0-milestone12 (including) |
Tomcat | Apache | 9.0.0-milestone13 (including) | 9.0.0-milestone13 (including) |
Tomcat | Apache | 9.0.0-milestone14 (including) | 9.0.0-milestone14 (including) |
Tomcat | Apache | 9.0.0-milestone15 (including) | 9.0.0-milestone15 (including) |
Tomcat | Apache | 9.0.0-milestone16 (including) | 9.0.0-milestone16 (including) |
Tomcat | Apache | 9.0.0-milestone17 (including) | 9.0.0-milestone17 (including) |
Tomcat | Apache | 9.0.0-milestone18 (including) | 9.0.0-milestone18 (including) |
Tomcat | Apache | 9.0.0-milestone19 (including) | 9.0.0-milestone19 (including) |
Tomcat | Apache | 9.0.0-milestone2 (including) | 9.0.0-milestone2 (including) |
Tomcat | Apache | 9.0.0-milestone20 (including) | 9.0.0-milestone20 (including) |
Tomcat | Apache | 9.0.0-milestone21 (including) | 9.0.0-milestone21 (including) |
Tomcat | Apache | 9.0.0-milestone22 (including) | 9.0.0-milestone22 (including) |
Tomcat | Apache | 9.0.0-milestone23 (including) | 9.0.0-milestone23 (including) |
Tomcat | Apache | 9.0.0-milestone24 (including) | 9.0.0-milestone24 (including) |
Tomcat | Apache | 9.0.0-milestone25 (including) | 9.0.0-milestone25 (including) |
Tomcat | Apache | 9.0.0-milestone26 (including) | 9.0.0-milestone26 (including) |
Tomcat | Apache | 9.0.0-milestone27 (including) | 9.0.0-milestone27 (including) |
Tomcat | Apache | 9.0.0-milestone3 (including) | 9.0.0-milestone3 (including) |
Tomcat | Apache | 9.0.0-milestone4 (including) | 9.0.0-milestone4 (including) |
Tomcat | Apache | 9.0.0-milestone5 (including) | 9.0.0-milestone5 (including) |
Tomcat | Apache | 9.0.0-milestone6 (including) | 9.0.0-milestone6 (including) |
Tomcat | Apache | 9.0.0-milestone7 (including) | 9.0.0-milestone7 (including) |
Tomcat | Apache | 9.0.0-milestone8 (including) | 9.0.0-milestone8 (including) |
Tomcat | Apache | 9.0.0-milestone9 (including) | 9.0.0-milestone9 (including) |