CVE:CVE-2018-11784
CNNVD:CNNVD-201810-135
Apache Tomcat是美国阿帕奇（Apache）软件基金会的一款轻量级Web应用服务器。该程序实现了对Servlet和JavaServer Page（JSP）的支持。
Apache Tomcat 9.0.0.M1版本至9.0.11版本，8.5.0版本至8.5.33版本和7.0.23版本至7.0.90版本中的默认servlet存在安全漏洞。攻击者可借助特制的URL利用该漏洞重定向用户至任意web站点。
solution:Upgrade apache tomcat to a higher version than 7.0.90,8.5.33,9.0.11,9.0.0,9.0.0:m1,9.0.0:m10,9.0.0:m11,9.0.0:m12,9.0.0:m13,9.0.0:m14,9.0.0:m15,9.0.0:m16,9.0.0:m17,9.0.0:m18,9.0.0:m19,9.0.0:m2,9.0.0:m20,9.0.0:m21,9.0.0:m22,9.0.0:m23,9.0.0:m24,9.0.0:m25,9.0.0:m26,9.0.0:m27,9.0.0:m3,9.0.0:m4,9.0.0:m5,9.0.0:m6,9.0.0:m7,9.0.0:m8,9.0.0:m9,and avoid the version [7.0.23,7.0.90],[8.5.0,8.5.33],[9.0.1,9.0.11],9.0.0,9.0.0:m1,9.0.0:m10,9.0.0:m11,9.0.0:m12,9.0.0:m13,9.0.0:m14,9.0.0:m15,9.0.0:m16,9.0.0:m17,9.0.0:m18,9.0.0:m19,9.0.0:m2,9.0.0:m20,9.0.0:m21,9.0.0:m22,9.0.0:m23,9.0.0:m24,9.0.0:m25,9.0.0:m26,9.0.0:m27,9.0.0:m3,9.0.0:m4,9.0.0:m5,9.0.0:m6,9.0.0:m7,9.0.0:m8,9.0.0:m9; Upgrade debian debian_linux to a higher version than 8.0,and avoid the version 8.0; Upgrade canonical ubuntu_linux to a higher version than 14.04,16.04,and avoid the version 14.04,16.04; Upgrade netapp snap_creator_framework to a higher version than -; Upgrade redhat enterprise_linux_desktop to a higher version than 7.0,and avoid the version 7.0; Upgrade redhat enterprise_linux_server to a higher version than 7.0,7.6,and avoid the version 7.0,7.6; Upgrade redhat enterprise_linux_server_aus to a higher version than 7.6,and avoid the version 7.6; Upgrade redhat enterprise_linux_server_eus to a higher version than 7.6,and avoid the version 7.6; Upgrade redhat enterprise_linux_server_tus to a higher version than 7.6,and avoid the version 7.6; Upgrade redhat enterprise_linux_workstation to a higher version than 7.0,and avoid the version 7.0; Upgrade oracle communications_application_session_controller to a higher version than 3.7.1,3.8.0,and avoid the version 3.7.1,3.8.0; Upgrade oracle hospitality_guest_access to a higher version than 4.2.0,4.2.1,and avoid the version 4.2.0,4.2.1; Upgrade oracle instantis_enterprisetrack to a higher version than 17.1,17.2,17.3,and avoid the version 17.1,17.2,17.3; Upgrade oracle retail_order_broker to a higher version than 5.1,5.2,15.0,and avoid the version 5.1,5.2,15.0; Upgrade oracle secure_global_desktop to a higher version than 5.4,and avoid the version 5.4