On 21/07/2026 11:15, Anushka sur wrote:
Hi Mark,
As you suggested, we created a dedicated virtual host in the |
server.xml| file. However, even after adding the virtual host
configuration, the issue still persists.
For example, when we access the application using:
|https://sdcoradb5.hdfc.com:8083/ORDS <https://sdcoradb5.hdfc.com:8083/
ORDS>|
and replace |sdcoradb5.hdfc.com:8083 <http://sdcoradb5.hdfc.com:8083>|
with |bing.com <http://bing.com>|, the request is still being redirected
instead of being rejected.
Which is it? http or https?
Could you please confirm whether our |server.xml| configuration is
correct, or if there are any additional settings or configurations that
need to be added to ensure only the intended host is accepted?
I could, if you had provided details of your settings. Screenshots will
get rejected by the mailing list. It would be better to simply paste the
contents of server.xml into a plain text email.
Mark
Any guidance would be greatly appreciated.
Thank you, Anushka Sur
In the screenshot..we have taken other instance for testing
 Screenshot for your reference:--
On Thu, 16 Jul, 2026, 11:40 Anushka sur, <[email protected]
<mailto:[email protected]>> wrote:
Sorry for the confusion..We are using tomcat version 9.0.110
On Thu, 16 Jul, 2026, 11:26 Anushka sur, <[email protected]
<mailto:[email protected]>> wrote:
Hi everyone,
Thanks for the feedback. You are right — Tomcat 9.0.110 is very
old, and we will treat the upgrade as the first remediation step.
We will check the issue on a newer supported Tomcat release and
verify whether the redirect problem is still reproducible there.
If it is fixed by the upgrade, we will proceed with the newer
version
if not, as suggested by mark thomas we will create virtual host.
Thanks for pointing this out.
Best regards,
Anushka Sur
On Thu, 16 Jul, 2026, 01:33 Christopher Schultz,
<[email protected]
<mailto:[email protected]>> wrote:
Mark,
On 7/15/26 9:56 AM, Mark Thomas wrote:
> 15 Jul 2026 11:10:41 Anushka sur <[email protected]
<mailto:[email protected]>>:
>
>> We have identified a VAPT issue in our Oracle APEX
application
>> deployed on
>> ORDS 24.1.11 running on Apache Tomcat 9.0.11.
>
> That is horribly out of date. You might want to check the
list of
> published CVEs for 9.0.x
+1
The real VAPT issue should be "holy @#$%&* your Tomcat
version is *how*
old?"
-chris
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
<mailto:[email protected]>
For additional commands, e-mail: users-
[email protected] <mailto:[email protected]>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
