CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2023-41080
Medium (6.1). EPSS 6.5% chance of exploitation in the next 30 days. Fixed in org.apache.tomcat:tomcat 10.1.13, 11.0.0-M11, 8.5.93.
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92.
Older, EOL versions may also be affected.
The vulnerability is limited to the ROOT (default) web application.
Severity
- EPSS
- 6.5% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
- CWE
- CWE-601
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:tomcat
- debian:debian_linux
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-q3mw-pvr8-9ggc | Maven | org.apache.tomcat:tomcat | >=11.0.0-M1 <11.0.0-M11 | 11.0.0-M11 |
| GHSA-q3mw-pvr8-9ggc | Maven | org.apache.tomcat:tomcat | >=10.1.0-M1 <10.1.13 | 10.1.13 |
| GHSA-q3mw-pvr8-9ggc | Maven | org.apache.tomcat:tomcat | >=9.0.0-M1 <9.0.80 | 9.0.80 |
| GHSA-q3mw-pvr8-9ggc | Maven | org.apache.tomcat:tomcat | >=8.5.0 <8.5.93 | 8.5.93 |
| GHSA-q3mw-pvr8-9ggc | Maven | org.apache.tomcat.embed:tomcat-embed-core | >=8.5.0 <8.5.93 | 8.5.93 |
| GHSA-q3mw-pvr8-9ggc | Maven | org.apache.tomcat.embed:tomcat-embed-core | >=9.0.0-M1 <9.0.80 | 9.0.80 |
| GHSA-q3mw-pvr8-9ggc | Maven | org.apache.tomcat.embed:tomcat-embed-core | >=10.1.0-M1 <10.1.13 | 10.1.13 |
| GHSA-q3mw-pvr8-9ggc | Maven | org.apache.tomcat.embed:tomcat-embed-core | >=11.0.0-M1 <11.0.0-M11 | 11.0.0-M11 |
| GHSA-q3mw-pvr8-9ggc | Maven | org.apache.tomcat:tomcat-catalina | >=10.1.0-M1 <10.1.13 | 10.1.13 |
| GHSA-q3mw-pvr8-9ggc | Maven | org.apache.tomcat:tomcat-catalina | >=9.0.0-M1 <9.0.80 | 9.0.80 |
| GHSA-q3mw-pvr8-9ggc | Maven | org.apache.tomcat:tomcat-catalina | >=8.5.0 <8.5.93 | 8.5.93 |