6.1
CVE-2023-41080
- EPSS 5.97%
- Veröffentlicht 25.08.2023 21:15:09
- Zuletzt bearbeitet 07.08.2025 11:15:27
- Erkennungen
LoginApache Tomcat: Open redirect with FORM authentication
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92.
Older, EOL versions may also be affected.
The vulnerability is limited to the ROOT (default) web application.Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Debian ≫ Debian Linux Version 10.0
Debian ≫ Debian Linux Version 11.0
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 5.97% | 0.924 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 6.1 | 2.8 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
|
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html
https://www.debian.org/security/2023/dsa-5522
https://www.debian.org/security/2023/dsa-5521
https://lists.apache.org/thread/71wvwprtx2j2m54fovq9zr7gbm2wow2f
https://security.netapp.com/advisory/ntap-20230921-0006/