Open Redirect

2023-08-2911:34:15

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

apache tomcat

open redirect

vulnerability

request uri

form submission

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.002 Low

EPSS

Percentile

64.6%

JSON

Apache tomcat is vulnerable to Open Redirect Vulnerability. The vulnerability arises due to not validating/sanitizing the request uri used to redirect a user back to the original page after a successful form submission. The attacker can redirect a user to any malicious crafted url leading to open redirect vulnerability.

CPENameOperatorVersion
tomcat-catalinale11.0.0-M10
tomcat-catalinale8.5.92
tomcat-catalinale10.1.12
tomcat-catalinale9.0.79
tomcat9:sideq9.0.40-1
tomcat9:bullseyeeq9.0.43-1
tomcat9:bustereq9.0.31-1~deb10u3
tomcat9:bustereq9.0.31-1~deb10u2
tomcat9:bustereq9.0.31-1~deb10u4
tomcat9:bustereq9.0.31-1~deb10u5

Name	Operator	Version
tomcat-catalina	le	11.0.0-M10
tomcat-catalina	le	8.5.92
tomcat-catalina	le	10.1.12
tomcat-catalina	le	9.0.79
tomcat9:sid	eq	9.0.40-1
tomcat9:bullseye	eq	9.0.43-1
tomcat9:buster	eq	9.0.31-1~deb10u3
tomcat9:buster	eq	9.0.31-1~deb10u2
tomcat9:buster	eq	9.0.31-1~deb10u4
tomcat9:buster	eq	9.0.31-1~deb10u5