CVE-2018-11784

CVE-2018-11784: vulnerability in Apache Tomcat

Published · Updated

Follow this CVE+ Monitor Apache Tomcat+ Monitor org.apache.tomcat.embed:tomcat-embed-core

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

60Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 98%
from disclosure to weapon1013 days
Published on NVDOct 4
1st PoC+1013d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
8 products
Red Hat JBoss Data Grid 6 · Red Hat JBoss Data Virtualization 6 · Red Hat JBoss Enterprise Application Platform 6 · Red Hat JBoss Enterprise Web Server 2 · Red Hat JBoss Fuse 6 · and others 3
no_fix_planned: Out of support scope
Fixed
17 products (226 components)
Red Hat Enterprise Linux AppStream (v. 8) · Red Hat JBoss Web Server 3.1 for RHEL 6 · Red Hat JBoss Web Server 3.1 for RHEL 7 · Red Hat JBoss Web Server 5.0 for RHEL 6 Server · Red Hat JBoss Web Server 5.0 for RHEL 7 Server · and others 12
fix ↗
Not affected
11 products (37 components) — because the vulnerable code is not present in the product
Red Hat JBoss Enterprise Web Server 2 · Red Hat Enterprise Linux 6 · Red Hat Software Collections · Red Hat BPM Suite 6 · Red Hat Fuse 7 · and others 6
When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.
Affected products
Apache Software Foundation · Apache Tomcat
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Apache Tomcat

In the same product, most dangerous first.

CVE-2017-12617HIGHCVE-2017-12617EPSS 100.0%KEVCVE-2025-24813CRITICALApache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUTEPSS 99.9%KEVCVE-2017-12615HIGHCVE-2017-12615EPSS 99.7%KEVCVE-2026-34486HIGHApache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptorEPSS 98.5%KEVCVE-2016-8735CRITICALCVE-2016-8735EPSS 90.3%KEVCVE-2021-33037—Incorrect Transfer-Encoding handling with HTTP/1.0EPSS 74.7%