Apache Tomcat Open Redirect

Description

Because it fails to properly sanitise user-supplied input, Apache Tomcat versions previous to 9.0.12, 8.5.34, and 7.0.91 are vulnerable to an open-redirection vulnerability.

Recommendations

• Upgrade to Apache Tomcat 9.0.12 or later.

• Upgrade to Apache Tomcat 8.5.34 or later.

• Upgrade to Apache Tomcat 7.0.91 or later.

• Use mapperDirectoryRedirectEnabled=”true” and mapperContextRootRedirectEnabled=”true” on the Context to ensure that redirects are issued by the Mapper rather than the default Servlet.

Written by

Febna V M

Cyber Security Engineer

Febna once spent an entire evening arguing with an AI chatbot just to prove that machines can be confidently wrong. The debate ended with no clear winner, but it did spark her curiosity for the fascinating world of artificial intelligence. Today, she works at the intersection of AI and cybersecurity, helping build smarter systems while making sure they don’t become too smart for their own good. When she’s not exploring the future of technology, she’s probably asking “but what if?” one more time.