CVE-2018-11784 (CNNVD-201810-135)

MEDIUM 有利用代码
中文标题:
Apache Tomcat 输入验证错误漏洞
英文标题:
When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to...
CVSS分数: 4.3
发布时间: 2018-10-04 13:00:00
漏洞类型: 输入验证错误
状态: PUBLISHED
数据质量分数: 0.30
数据版本: v4
漏洞描述
中文描述:

Apache Tomcat是美国阿帕奇（Apache）软件基金会的一款轻量级Web应用服务器。该程序实现了对Servlet和JavaServer Page（JSP）的支持。 Apache Tomcat 9.0.0.M1版本至9.0.11版本，8.5.0版本至8.5.33版本和7.0.23版本至7.0.90版本中的默认servlet存在安全漏洞。攻击者可借助特制的URL利用该漏洞重定向用户至任意web站点。

英文描述:

When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.

CWE类型:
CWE-601
标签:
webapps multiple Central InfoSec
受影响产品
厂商 产品 版本 版本范围 平台 CPE
Apache Software Foundation Apache Tomcat 9.0.0.M1 to 9.0.11 - - cpe:2.3:a:apache_software_foundation:apache_tomcat:9.0.0.m1_to_9.0.11:*:*:*:*:*:*:*
Apache Software Foundation Apache Tomcat 8.5.0 to 8.5.33 - - cpe:2.3:a:apache_software_foundation:apache_tomcat:8.5.0_to_8.5.33:*:*:*:*:*:*:*
Apache Software Foundation Apache Tomcat 7.0.23 to 7.0.90 - - cpe:2.3:a:apache_software_foundation:apache_tomcat:7.0.23_to_7.0.90:*:*:*:*:*:*:*
apache tomcat * - - cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
apache tomcat 9.0.0 - - cpe:2.3:a:apache:tomcat:9.0.0:*:*:*:*:*:*:*
debian debian_linux 8.0 - - cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
canonical ubuntu_linux 14.04 - - cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
canonical ubuntu_linux 16.04 - - cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
netapp snap_creator_framework - - - cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*
redhat enterprise_linux_desktop 7.0 - - cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
redhat enterprise_linux_server 7.0 - - cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
redhat enterprise_linux_server 7.6 - - cpe:2.3:o:redhat:enterprise_linux_server:7.6:*:*:*:*:*:*:*
redhat enterprise_linux_server_aus 7.6 - - cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
redhat enterprise_linux_server_eus 7.6 - - cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
redhat enterprise_linux_server_tus 7.6 - - cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
redhat enterprise_linux_workstation 7.0 - - cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
oracle communications_application_session_controller 3.7.1 - - cpe:2.3:a:oracle:communications_application_session_controller:3.7.1:*:*:*:*:*:*:*
oracle communications_application_session_controller 3.8.0 - - cpe:2.3:a:oracle:communications_application_session_controller:3.8.0:*:*:*:*:*:*:*
oracle hospitality_guest_access 4.2.0 - - cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:*
oracle hospitality_guest_access 4.2.1 - - cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:*
oracle instantis_enterprisetrack 17.1 - - cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*
oracle instantis_enterprisetrack 17.2 - - cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*
oracle instantis_enterprisetrack 17.3 - - cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*
oracle retail_order_broker 5.1 - - cpe:2.3:a:oracle:retail_order_broker:5.1:*:*:*:*:*:*:*
oracle retail_order_broker 5.2 - - cpe:2.3:a:oracle:retail_order_broker:5.2:*:*:*:*:*:*:*
oracle retail_order_broker 15.0 - - cpe:2.3:a:oracle:retail_order_broker:15.0:*:*:*:*:*:*:*
oracle secure_global_desktop 5.4 - - cpe:2.3:a:oracle:secure_global_desktop:5.4:*:*:*:*:*:*:*
解决方案
中文解决方案:
（暂无数据）
英文解决方案:
（暂无数据）
临时解决方案:
（暂无数据）
参考链接
无标题 x_refsource_CONFIRM
cve.org
访问
[announce] 20181003 [SECURITY] CVE-2018-11784 Apache Tomcat - Open Redirect mailing-list
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
105524 vdb-entry
cve.org
访问
RHSA-2019:0131 vendor-advisory
cve.org
访问
RHSA-2019:0485 vendor-advisory
cve.org
访问
RHSA-2019:0130 vendor-advisory
cve.org
访问
[debian-lts-announce] 20181014 [SECURITY] [DLA 1544-1] tomcat7 security update mailing-list
cve.org
访问
USN-3787-1 vendor-advisory
cve.org
访问
[debian-lts-announce] 20181015 [SECURITY] [DLA 1545-1] tomcat8 security update mailing-list
cve.org
访问
[tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
cve.org
访问
[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
cve.org
访问
[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
cve.org
访问
[tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
cve.org
访问
[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
cve.org
访问
FEDORA-2018-b18f9dd65b vendor-advisory
cve.org
访问
[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
cve.org
访问
[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
cve.org
访问
[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
cve.org
访问
[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
cve.org
访问
[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
cve.org
访问
[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
openSUSE-SU-2019:1547 vendor-advisory
cve.org
访问
RHSA-2019:1529 vendor-advisory
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
openSUSE-SU-2019:1814 vendor-advisory
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
DSA-4596 vendor-advisory
cve.org
访问
20191229 [SECURITY] [DSA 4596-1] tomcat8 security update mailing-list
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/ mailing-list
cve.org
访问
[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/ mailing-list
cve.org
访问
[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/ mailing-list
cve.org
访问
[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/ mailing-list
cve.org
访问
[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/ mailing-list
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
ExploitDB EDB-50118 EXPLOIT
exploitdb
访问
Download Exploit EDB-50118 EXPLOIT
exploitdb
访问
CVE Reference: CVE-2018-11784 ADVISORY
cve.org
访问
CVSS评分详情
4.3
MEDIUM
CVSS向量: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS版本: 3.0
机密性
NONE
完整性
LOW
可用性
NONE
时间信息
发布时间:
2018-10-04 13:00:00
修改时间:
2024-09-16 17:04:04
创建时间:
2025-11-11 15:35:01
更新时间:
2025-11-11 16:58:22
利用信息
此漏洞有可利用代码！
利用代码数量: 1
利用来源:
未知
数据源详情
数据源 记录ID 版本 提取时间
CVE cve_CVE-2018-11784 2025-11-11 15:19:38 2025-11-11 07:35:01
NVD nvd_CVE-2018-11784 2025-11-11 14:55:59 2025-11-11 07:43:37
CNNVD cnnvd_CNNVD-201810-135 2025-11-11 15:10:05 2025-11-11 07:53:58
EXPLOITDB exploitdb_EDB-50118 2025-11-11 15:05:28 2025-11-11 08:58:22
版本与语言
当前版本: v4
主要语言: EN
支持语言:
EN ZH
其他标识符:
:
:
安全公告
暂无安全公告信息
变更历史
v4 EXPLOITDB
2025-11-11 16:58:22
references_count: 39 → 42; tags_count: 0 → 3; data_sources: ['cnnvd', 'cve', 'nvd'] → ['cnnvd', 'cve', 'exploitdb', 'nvd']
查看详细变更
  • references_count: 39 -> 42
  • tags_count: 0 -> 3
  • data_sources: ['cnnvd', 'cve', 'nvd'] -> ['cnnvd', 'cve', 'exploitdb', 'nvd']
v3 CNNVD
2025-11-11 15:53:58
vulnerability_type: 未提取 → 输入验证错误; cnnvd_id: 未提取 → CNNVD-201810-135; data_sources: ['cve', 'nvd'] → ['cnnvd', 'cve', 'nvd']
查看详细变更
  • vulnerability_type: 未提取 -> 输入验证错误
  • cnnvd_id: 未提取 -> CNNVD-201810-135
  • data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
v2 NVD
2025-11-11 15:43:37
cvss_score: 未提取 → 4.3; cvss_vector: NOT_EXTRACTED → CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N; cvss_version: NOT_EXTRACTED → 3.0; affected_products_count: 3 → 27; data_sources: ['cve'] → ['cve', 'nvd']
查看详细变更
  • cvss_score: 未提取 -> 4.3
  • cvss_vector: NOT_EXTRACTED -> CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
  • cvss_version: NOT_EXTRACTED -> 3.0
  • affected_products_count: 3 -> 27
  • data_sources: ['cve'] -> ['cve', 'nvd']