CVE-2023-41080

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. Older, EOL versions may also be affected.

The vulnerability is limited to the ROOT (default) web application.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Tomcat	>= 11.0.0-M1, <= 11.0.0-M10; >= 10.1.0-M1, <= 10.0.12; >= 9.0.0-M1, <= 9.0.79; >= 8.5.0, <= 8.5.92

References

https://lists.apache.org/thread/71wvwprtx2j2m54fovq9zr7gbm2wow2fIssue Tracking, Patch, Vendor Advisory
https://lists.apache.org/thread/71wvwprtx2j2m54fovq9zr7gbm2wow2fIssue Tracking, Patch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/10/msg00020.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20230921-0006/Third Party Advisory
https://www.debian.org/security/2023/dsa-5521Third Party Advisory
https://www.debian.org/security/2023/dsa-5522Third Party Advisory

Timeline

Published: Aug 25, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-410817.5Important: Authentication Bypass CVE-2023-41081 The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a conf CVE-2023-410824.4Null pointer dereference for some Intel(R) CST software before version 2.1.10300 may allow an authenticated user to potentially enable denia CVE-2023-410849.8Session management within the web application is incorrect and allows attackers to steal session cookies to perform a multitude of actions t CVE-2023-410857.5When IPSec is configured on a Virtual Server, undisclosed traffic can cause TMM to terminate. Note: Software versions which have reached E CVE-2023-410868.8Cross-site request forgery (CSRF) vulnerability exists in FURUNO SYSTEMS wireless LAN access point devices. If a user views a malicious page CVE-2023-410886.5The affected product is vulnerable to a cleartext transmission of sensitive information vulnerability, which may allow an attacker with acce CVE-2023-410898.8The affected product is vulnerable to an improper authentication vulnerability, which may allow an attacker to impersonate a legitimate user CVE-2023-41094.8The Ninja Forms WordPress Ninja Forms Contact Form WordPress plugin before 3.6.26 was affected by a HTML Injection security vulnerability.CVE-2023-410906.4Race condition in some Intel(R) MAS software before version 2.3 may allow a privileged user to potentially enable escalation of privilege vi CVE-2023-410917.8Uncontrolled search path for some Intel(R) MPI Library Software before version 2021.11 may allow an authenticated user to potentially enable CVE-2023-410927.6Unchecked return value in SDM firmware for Intel(R) Stratix 10 and Intel(R) Agilex 7 FPGAs before version 23.3 may allow an authenticated us CVE-2023-410933.1Use After Free vulnerability in Silicon Labs Bluetooth SDK on 32 bit, ARM may allow an attacker with precise timing capabilities to intercep