Skip to content
Fencer Vulns
medium 6.1

CVE-2023-41080 json

Apache Tomcat: Open redirect with FORM authentication

published 2023-08-25 3 y ago modified 2026-09-10 1 mo ago also BIT-tomcat-2023-41080 , EUVD-2023-2335 , GHSA-q3mw-pvr8-9ggc

cvss
6.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
6.5%
EPSS 6.5% chance of exploitation in 30 days, percentile 93%
public exploits
0
none known

Summary

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. Older, EOL versions may also be affected.

The vulnerability is limited to the ROOT (default) web application.

Patch / fix

  • maven org.apache.tomcat:tomcat 8.5.93, 9.0.80, 10.1.13, 11.0.0-M11
  • maven org.apache.tomcat.embed:tomcat-embed-core 8.5.93, 9.0.80, 10.1.13, 11.0.0-M11
  • maven org.apache.tomcat:tomcat-catalina 8.5.93, 9.0.80, 10.1.13
  • bitnami tomcat 8.5.93, 9.0.80, 10.1.13
  • tomcat9 Debian 14, Debian 13, Debian 12 9.0.70-2
  • tomcat10 Debian 12 10.1.6-1+deb12u1
  • tomcat10 Debian 14, Debian 13 10.1.13-1

debian advisories DEBIAN-CVE-2023-41080

  • tomcat9 Ubuntu 20.04 LTS 9.0.31-1ubuntu0.8
  • tomcat9 Ubuntu Pro 18.04 LTS 9.0.16-3ubuntu0.18.04.2+esm4
  • tomcat9 Ubuntu Pro 22.04 LTS 9.0.58-1ubuntu0.1+esm4

ubuntu advisories UBUNTU-CVE-2023-41080

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • tomcat RHEL 10.0 1:10.1.36-1.el10_0
  • tomcat-lib RHEL 10.0 1:10.1.36-1.el10_0
  • tomcat-webapps RHEL 10.0 1:10.1.36-1.el10_0
  • tomcat-el-5.0-api RHEL 10.0 1:10.1.36-1.el10_0
  • tomcat-docs-webapp RHEL 10.0 1:10.1.36-1.el10_0
  • tomcat-jsp-3.1-api RHEL 10.0 1:10.1.36-1.el10_0
  • tomcat-admin-webapps RHEL 10.0 1:10.1.36-1.el10_0
  • tomcat-servlet-6.0-api RHEL 10.0 1:10.1.36-1.el10_0

red hat advisories RHSA-2025:7497RHSA-2024:1324RHSA-2024:0474RHSA-2024:0125RHSA-2024:3814RHSA-2023:7622

  • tomcat SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES 15 SP3-LTSS +8 more 9.0.82-150200.46.1
  • tomcat SLES for SAP 12 SP5, SLES 12 SP5 9.0.36-3.108.1
  • tomcat SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 9.0.115-3.160.1
  • tomcat SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLE High Performance Computing 15 SP1-LTSS 9.0.36-150100.4.98.1

suse advisories SUSE-SU-2026:1058-1SUSE-SU-2023:4423-1SUSE-SU-2023:4129-1SUSE-SU-2023:3987-1

  • tomcat openSUSE Tumbleweed 9.0.80-1.1
  • tomcat10 openSUSE Tumbleweed 10.1.14-1.1

opensuse advisories openSUSE-SU-2024:13256-1openSUSE-SU-2024:13441-1

  • tomcat AlmaLinux 9 1:9.0.62-37.el9_3.1
  • tomcat-lib AlmaLinux 9 1:9.0.62-37.el9_3.1
  • tomcat-webapps AlmaLinux 9 1:9.0.62-37.el9_3.1
  • tomcat-el-3.0-api AlmaLinux 9 1:9.0.62-37.el9_3.1
  • tomcat-docs-webapp AlmaLinux 9 1:9.0.62-37.el9_3.1
  • tomcat-jsp-2.3-api AlmaLinux 9 1:9.0.62-37.el9_3.1
  • tomcat-admin-webapps AlmaLinux 9 1:9.0.62-37.el9_3.1
  • tomcat-servlet-4.0-api AlmaLinux 9 1:9.0.62-37.el9_3.1

almalinux advisories ALSA-2024:0474ALSA-2024:0125

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-41080 updated cvss 6.1

tomcat: Open Redirect vulnerability in FORM authentication

  • Red Hat build of OptaPlanner 8 tomcat Red Hat Decision Manager 7 tomcat
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux 7 tomcat, tomcat-lib, tomcat-jsvc, tomcat-javadoc, tomcat-webapps, tomcat-el-2.2-api, +4 more
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 pki-servlet-engine, pki-servlet-4.0-api, pki-servlet-container Red Hat Enterprise Linux 9 pki-servlet-engine, pki-servlet-4.0-api Red Hat Fuse 7 tomcat Red Hat JBoss Enterprise Application Platform 6 tomcat Red Hat OpenShift Application Runtimes tomcat Red Hat Process Automation 7 tomcat
    +1 more products
    Red Hat Single Sign-On 7 tomcat
    affected: no fix planned “Will not fix”
  • Red Hat JWS 6.0.1
    fixed: vendor fix RHSA-2024:1325
  • Red Hat AMQ Broker 7
    fixed: vendor fix RHSA-2023:5946
  • Red Hat AMQ Streams 2.6.0
    fixed: vendor fix RHSA-2023:7678
  • Red Hat Enterprise Linux AppStream (v. 8) tomcat 9.0.62-27.el8_9.2, tomcat-lib 9.0.62-27.el8_9.2, tomcat-webapps 9.0.62-27.el8_9.2, tomcat-el-3.0-api 9.0.62-27.el8_9.2, tomcat-docs-webapp 9.0.62-27.el8_9.2, tomcat-jsp-2.3-api 9.0.62-27.el8_9.2, +2 more
    fixed: vendor fix RHSA-2024:0125
  • Red Hat Enterprise Linux AppStream (v. 9) tomcat 9.0.62-37.el9_3.1, tomcat-lib 9.0.62-37.el9_3.1, tomcat-webapps 9.0.62-37.el9_3.1, tomcat-el-3.0-api 9.0.62-37.el9_3.1, tomcat-docs-webapp 9.0.62-37.el9_3.1, tomcat-jsp-2.3-api 9.0.62-37.el9_3.1, +2 more
    fixed: vendor fix RHSA-2024:0474
show 7 more
  • Red Hat Enterprise Linux AppStream (v. 10) tomcat 10.1.36-1.el10_0, tomcat-lib 10.1.36-1.el10_0, tomcat-webapps 10.1.36-1.el10_0, tomcat-el-5.0-api 10.1.36-1.el10_0, tomcat-docs-webapp 10.1.36-1.el10_0, tomcat-jsp-3.1-api 10.1.36-1.el10_0, +2 more
    fixed: vendor fix RHSA-2025:7497
  • Red Hat Enterprise Linux AppStream EUS (v.8.8) tomcat 9.0.87-1.el8_8.2, tomcat-lib 9.0.87-1.el8_8.2, tomcat-webapps 9.0.87-1.el8_8.2, tomcat-el-3.0-api 9.0.87-1.el8_8.2, tomcat-docs-webapp 9.0.87-1.el8_8.2, tomcat-jsp-2.3-api 9.0.87-1.el8_8.2, +2 more
    fixed: vendor fix RHSA-2024:3814
  • Red Hat JBoss Web Server 5
    fixed: vendor fix RHSA-2023:7623
  • Red Hat JBoss Web Server 5.7 for RHEL 7 Server jws5-tomcat 9.0.62-19.redhat_00017.1.el7jws, jws5-tomcat-lib 9.0.62-19.redhat_00017.1.el7jws, jws5-tomcat-javadoc 9.0.62-19.redhat_00017.1.el7jws, jws5-tomcat-selinux 9.0.62-19.redhat_00017.1.el7jws, jws5-tomcat-webapps 9.0.62-19.redhat_00017.1.el7jws, jws5-tomcat-java-jdk8 9.0.62-19.redhat_00017.1.el7jws, +6 more Red Hat JBoss Web Server 5.7 for RHEL 8 jws5-tomcat 9.0.62-19.redhat_00017.1.el8jws, jws5-tomcat-lib 9.0.62-19.redhat_00017.1.el8jws, jws5-tomcat-javadoc 9.0.62-19.redhat_00017.1.el8jws, jws5-tomcat-selinux 9.0.62-19.redhat_00017.1.el8jws, jws5-tomcat-webapps 9.0.62-19.redhat_00017.1.el8jws, jws5-tomcat-el-3.0-api 9.0.62-19.redhat_00017.1.el8jws, +4 more Red Hat JBoss Web Server 5.7 for RHEL 9 jws5-tomcat 9.0.62-19.redhat_00017.1.el9jws, jws5-tomcat-lib 9.0.62-19.redhat_00017.1.el9jws, jws5-tomcat-javadoc 9.0.62-19.redhat_00017.1.el9jws, jws5-tomcat-selinux 9.0.62-19.redhat_00017.1.el9jws, jws5-tomcat-webapps 9.0.62-19.redhat_00017.1.el9jws, jws5-tomcat-el-3.0-api 9.0.62-19.redhat_00017.1.el9jws, +4 more
    fixed: vendor fix RHSA-2023:7622
  • Red Hat JBoss Web Server 6.0 for RHEL 8 jws6-tomcat 10.1.8-6.redhat_00013.1.el8jws, jws6-tomcat-lib 10.1.8-6.redhat_00013.1.el8jws, jws6-tomcat-javadoc 10.1.8-6.redhat_00013.1.el8jws, jws6-tomcat-selinux 10.1.8-6.redhat_00013.1.el8jws, jws6-tomcat-webapps 10.1.8-6.redhat_00013.1.el8jws, jws6-tomcat-el-5.0-api 10.1.8-6.redhat_00013.1.el8jws, +4 more Red Hat JBoss Web Server 6.0 for RHEL 9 jws6-tomcat 10.1.8-6.redhat_00013.1.el9jws, jws6-tomcat-lib 10.1.8-6.redhat_00013.1.el9jws, jws6-tomcat-javadoc 10.1.8-6.redhat_00013.1.el9jws, jws6-tomcat-selinux 10.1.8-6.redhat_00013.1.el9jws, jws6-tomcat-webapps 10.1.8-6.redhat_00013.1.el9jws, jws6-tomcat-el-5.0-api 10.1.8-6.redhat_00013.1.el9jws, +4 more
    fixed: vendor fix RHSA-2024:1324
  • Red Hat OpenShift Dev Spaces 3 devspaces/server-rhel8 3.15-3
    fixed: vendor fix RHSA-2024:4631
  • Red Hat A-MQ Clients 2 tomcat Red Hat build of Apache Camel for Spring Boot 3 tomcat Red Hat Data Grid 8 tomcat Red Hat Integration Camel K 1 tomcat Red Hat JBoss Data Grid 7 tomcat Red Hat JBoss Enterprise Application Platform 7 tomcat
    +6 more products
    Red Hat JBoss Enterprise Application Platform 8 tomcat Red Hat JBoss Enterprise Application Platform Expansion Pack tomcat Red Hat JBoss Web Server 5.7 for RHEL 7 Server jws5-tomcat-native 1.2.31-16.redhat_16.el7jws Red Hat JBoss Web Server 5.7 for RHEL 8 jws5-tomcat-native 1.2.31-16.redhat_16.el8jws Red Hat JBoss Web Server 5.7 for RHEL 9 jws5-tomcat-native 1.2.31-16.redhat_16.el9jws Red Hat OpenShift Dev Spaces 3 devspaces/udi-rhel8 3.15-5, devspaces/code-rhel8 3.15-4, devspaces/idea-rhel8 3.15-5, devspaces/traefik-rhel8 3.15-2, devspaces/dashboard-rhel8 3.15-6, devspaces/configbump-rhel8 3.15-2, +6 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

6.46% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
GitHub 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
OSV 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
maven org.apache.tomcat:tomcat
>=11.0.0-M1, <11.0.0-M11
>=10.1.0-M1, <10.1.13
>=9.0.0-M1, <9.0.80
>=8.5.0, <8.5.93
11.0.0-M11
10.1.13
9.0.80
8.5.93
maven org.apache.tomcat.embed:tomcat-embed-core
>=8.5.0, <8.5.93
>=9.0.0-M1, <9.0.80
>=10.1.0-M1, <10.1.13
>=11.0.0-M1, <11.0.0-M11
8.5.93
9.0.80
10.1.13
11.0.0-M11
maven org.apache.tomcat:tomcat-catalina
>=10.1.0-M1, <10.1.13
>=9.0.0-M1, <9.0.80
>=8.5.0, <8.5.93
10.1.13
9.0.80
8.5.93
bitnami tomcat
>=8.5.0, <8.5.93
>=9.0.0, <9.0.80
>=10.1.0, <10.1.13
8.5.93
9.0.80
10.1.13

Affected products

  • Apache Software Foundation Apache Tomcat

Classification

Weakness
  • CWE-601 URL Redirection to Untrusted Site

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.