Hi Mark, As you suggested, we created a dedicated virtual host in the server.xml file. However, even after adding the virtual host configuration, the issue still persists.
For example, when we access the application using: https://sdcoradb5.hdfc.com:8083/ORDS and replace sdcoradb5.hdfc.com:8083 with bing.com, the request is still being redirected instead of being rejected. Could you please confirm whether our server.xml configuration is correct, or if there are any additional settings or configurations that need to be added to ensure only the intended host is accepted? Any guidance would be greatly appreciated. Thank you, Anushka Sur In the screenshot..we have taken other instance for testing Screenshot for your reference:-- On Thu, 16 Jul, 2026, 11:40 Anushka sur, <[email protected]> wrote: > Sorry for the confusion..We are using tomcat version 9.0.110 > > On Thu, 16 Jul, 2026, 11:26 Anushka sur, <[email protected]> wrote: > >> Hi everyone, >> >> Thanks for the feedback. You are right — Tomcat 9.0.110 is very old, and >> we will treat the upgrade as the first remediation step. >> >> We will check the issue on a newer supported Tomcat release and verify >> whether the redirect problem is still reproducible there. If it is fixed by >> the upgrade, we will proceed with the newer version >> >> if not, as suggested by mark thomas we will create virtual host. >> >> Thanks for pointing this out. >> >> Best regards, >> Anushka Sur >> >> On Thu, 16 Jul, 2026, 01:33 Christopher Schultz, < >> [email protected]> wrote: >> >>> Mark, >>> >>> On 7/15/26 9:56 AM, Mark Thomas wrote: >>> > 15 Jul 2026 11:10:41 Anushka sur <[email protected]>: >>> > >>> >> We have identified a VAPT issue in our Oracle APEX application >>> >> deployed on >>> >> ORDS 24.1.11 running on Apache Tomcat 9.0.11. >>> > >>> > That is horribly out of date. You might want to check the list of >>> > published CVEs for 9.0.x >>> >>> +1 >>> >>> The real VAPT issue should be "holy @#$%&* your Tomcat version is *how* >>> old?" >>> >>> -chris >>> >>> >>> --------------------------------------------------------------------- >>> To unsubscribe, e-mail: [email protected] >>> For additional commands, e-mail: [email protected] >>> >>>
