CVE-2018-11784: Apache Tomcat default servlet open redirect on directory requests

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

medium priorityCVSS rates it 4.3 (medium) with no confidentiality or availability impact, but the very high EPSS score and broad Tomcat deployment justify prompt patching.

What it is

The Apache Tomcat default servlet generated directory redirects (for example '/foo' to '/foo/') using attacker-controllable input, allowing the redirect target to be set to any URI. This is a classic open redirect (CWE-601) affecting Tomcat 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90, and it matters because Tomcat is widely deployed and the redirect can be used to lend a trusted hostname to phishing or credential-harvesting links.

Impact

An attacker gains the ability to send a victim from a trusted Tomcat-hosted URL to an arbitrary external site. There is no data disclosure or code execution; the impact is limited to integrity of the redirect response and abuse of the site's reputation.

Attack surface

Reachable over the network via HTTP requests to a directory path handled by the default servlet; no authentication is required, but the victim must follow the crafted link (UI:R in the CVSS vector).

Exploitation

Not listed in CISA KEV and no ransomware association is recorded, but EPSS is very high (0.94494, 99.8th percentile) and public proof-of-concept material exists (Packet Storm advisory), indicating active interest even though no in-the-wild exploitation is confirmed by this record.

What to do

• Upgrade Tomcat to a release after 9.0.11, 8.5.33 or 7.0.90, or apply the vendor fix for your distribution (Red Hat, Debian, Ubuntu, SUSE errata are referenced).
• If immediate upgrade is not possible, front Tomcat with a reverse proxy that validates or rewrites Location headers on redirect responses.
• Disable or restrict the default servlet's directory redirect behavior where the application does not rely on it.
• Review and constrain any application logic that reflects request paths into redirect targets.
• Educate users about open-redirect phishing links originating from trusted internal hostnames.

Detection

• Monitor web logs for requests to directory paths without a trailing slash that return 3xx responses with an external Location header.
• Alert on Location headers in Tomcat responses pointing to domains outside your own.
• Correlate repeated 302/301 responses to the same client from varied crafted paths, which may indicate scanning or phishing campaign use.
• Check for the Packet Storm PoC pattern in HTTP request logs against Tomcat default servlet paths.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.