6.1

CVE-2023-41080

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92.
Older, EOL versions may also be affected.


The vulnerability is limited to the ROOT (default) web application.

Data is provided by the National Vulnerability Database (NVD)
Apache ≫ Tomcat Version >= 8.5.0 <= 8.5.92
Apache ≫ Tomcat Version >= 9.0.0 <= 9.0.79
Apache ≫ Tomcat Version >= 10.1.0 <= 10.1.12
Apache ≫ Tomcat Version11.0.0 Updatemilestone1
Apache ≫ Tomcat Version11.0.0 Updatemilestone10
Apache ≫ Tomcat Version11.0.0 Updatemilestone2
Apache ≫ Tomcat Version11.0.0 Updatemilestone3
Apache ≫ Tomcat Version11.0.0 Updatemilestone4
Apache ≫ Tomcat Version11.0.0 Updatemilestone5
Apache ≫ Tomcat Version11.0.0 Updatemilestone6
Apache ≫ Tomcat Version11.0.0 Updatemilestone7
Apache ≫ Tomcat Version11.0.0 Updatemilestone8
Apache ≫ Tomcat Version11.0.0 Updatemilestone9
Debian ≫ Debian Linux Version10.0
Debian ≫ Debian Linux Version11.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 11.34% 0.933
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.