p PatchFirst

CVE-2023-41080

CVE-2023-41080 · Apache Tomcat: Open redirect with FORM authentication

This page contains facts from public vulnerability sources. Check the original advisory before updating.

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. Older, EOL versions may also be affected. The vulnerability is limited to the ROOT (default) web application.

CVSS 6.1 · Medium · EPSS 6.5% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • apache tomcat

    Versions
    • ≥ 11.0.0-M1, ≤ 11.0.0-M10: Affected (semver)
    • ≥ 10.1.0-M1, ≤ 10.0.12: Affected (semver)
    • ≥ 9.0.0-M1, ≤ 9.0.79: Affected (semver)
    • ≥ 8.5.0, ≤ 8.5.92: Affected (semver)
    • ≥ 3, < 8.5.0: Unknown (semver)
    • ≥ 10.0.0-M1, ≤ 10.0.27: Unknown (semver)

    No fix published

  • tomcat10 Debian:12

    Versions
    • 10.1.6-1
    Affected ranges
    • ECOSYSTEM: < 10.1.6-1+deb12u1

    Update to 10.1.6-1+deb12u1

  • tomcat10 Debian:13

    Affected ranges
    • ECOSYSTEM: < 10.1.13-1

    Update to 10.1.13-1

  • tomcat10 Debian:14

    Affected ranges
    • ECOSYSTEM: < 10.1.13-1

    Update to 10.1.13-1

  • tomcat9 Debian:12

    Affected ranges
    • ECOSYSTEM: < 9.0.70-2

    Update to 9.0.70-2

  • tomcat9 Debian:13

    Affected ranges
    • ECOSYSTEM: < 9.0.70-2

    Update to 9.0.70-2

  • tomcat9 Debian:14

    Affected ranges
    • ECOSYSTEM: < 9.0.70-2

    Update to 9.0.70-2

  • tomcat6 Ubuntu:Pro:14.04:LTS

    Versions
    • 6.0.37-1
    • 6.0.39-1
    • 6.0.39-1ubuntu0.1
    • 6.0.39-1ubuntu0.1+esm1
    • 6.0.39-1ubuntu0.1+esm2
    • 6.0.39-1ubuntu0.1+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat7 Ubuntu:Pro:14.04:LTS

    Versions
    • 7.0.42-1
    • 7.0.47-1
    • 7.0.50-1
    • 7.0.52-1
    • 7.0.52-1ubuntu0.1
    • 7.0.52-1ubuntu0.3
    • 7.0.52-1ubuntu0.6
    • 7.0.52-1ubuntu0.7
    • 7.0.52-1ubuntu0.8
    • 7.0.52-1ubuntu0.9
    • 7.0.52-1ubuntu0.10
    • 7.0.52-1ubuntu0.11
    • 7.0.52-1ubuntu0.13
    • 7.0.52-1ubuntu0.14
    • 7.0.52-1ubuntu0.15
    • 7.0.52-1ubuntu0.16
    • 7.0.52-1ubuntu0.16+esm1
    • 7.0.52-1ubuntu0.16+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat8 Ubuntu:Pro:16.04:LTS

    Versions
    • 8.0.26-1
    • 8.0.28-1
    • 8.0.30-1
    • 8.0.32-1
    • 8.0.32-1ubuntu1
    • 8.0.32-1ubuntu1.1
    • 8.0.32-1ubuntu1.2
    • 8.0.32-1ubuntu1.3
    • 8.0.32-1ubuntu1.4
    • 8.0.32-1ubuntu1.5
    • 8.0.32-1ubuntu1.6
    • 8.0.32-1ubuntu1.7
    • 8.0.32-1ubuntu1.8
    • 8.0.32-1ubuntu1.9
    • 8.0.32-1ubuntu1.10
    • 8.0.32-1ubuntu1.11
    • 8.0.32-1ubuntu1.13
    • 8.0.32-1ubuntu1.13+esm1
    • 8.0.32-1ubuntu1.13+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat7 Ubuntu:Pro:16.04:LTS

    Versions
    • 7.0.64-1
    • 7.0.68-1
    • 7.0.68-1ubuntu0.1
    • 7.0.68-1ubuntu0.3
    • 7.0.68-1ubuntu0.4
    • 7.0.68-1ubuntu0.4+esm1
    • 7.0.68-1ubuntu0.4+esm2
    • 7.0.68-1ubuntu0.4+esm3
    • 7.0.68-1ubuntu0.4+esm4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat8 Ubuntu:Pro:18.04:LTS

    Versions
    • 8.5.21-1ubuntu1
    • 8.5.29-1
    • 8.5.30-1
    • 8.5.30-1ubuntu1
    • 8.5.30-1ubuntu1.2
    • 8.5.30-1ubuntu1.3
    • 8.5.30-1ubuntu1.4
    • 8.5.39-1ubuntu1~18.04.1
    • 8.5.39-1ubuntu1~18.04.2
    • 8.5.39-1ubuntu1~18.04.3
    • 8.5.39-1ubuntu1~18.04.3+esm1
    • 8.5.39-1ubuntu1~18.04.3+esm2
    • 8.5.39-1ubuntu1~18.04.3+esm3
    • 8.5.39-1ubuntu1~18.04.3+esm4
    • 8.5.39-1ubuntu1~18.04.3+esm5
    • 8.5.39-1ubuntu1~18.04.3+esm6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat9 Ubuntu:Pro:18.04:LTS

    Versions
    • 9.0.16-3~18.04.1
    • 9.0.16-3ubuntu0.18.04.1
    • 9.0.16-3ubuntu0.18.04.2
    • 9.0.16-3ubuntu0.18.04.2+esm1
    • 9.0.16-3ubuntu0.18.04.2+esm2
    • 9.0.16-3ubuntu0.18.04.2+esm3
    Affected ranges
    • ECOSYSTEM: < 9.0.16-3ubuntu0.18.04.2+esm4

    Update to 9.0.16-3ubuntu0.18.04.2+esm4

  • tomcat9 Ubuntu:20.04:LTS

    Versions
    • 9.0.24-1
    • 9.0.27-1
    • 9.0.31-1
    • 9.0.31-1ubuntu0.1
    • 9.0.31-1ubuntu0.2
    • 9.0.31-1ubuntu0.3
    • 9.0.31-1ubuntu0.4
    • 9.0.31-1ubuntu0.5
    • 9.0.31-1ubuntu0.6
    • 9.0.31-1ubuntu0.7
    Affected ranges
    • ECOSYSTEM: < 9.0.31-1ubuntu0.8

    Update to 9.0.31-1ubuntu0.8

  • tomcat9 Ubuntu:Pro:22.04:LTS

    Versions
    • 9.0.43-3
    • 9.0.54-1
    • 9.0.55-1
    • 9.0.58-1
    • 9.0.58-1ubuntu0.1
    • 9.0.58-1ubuntu0.1+esm1
    • 9.0.58-1ubuntu0.1+esm2
    • 9.0.58-1ubuntu0.1+esm3
    Affected ranges
    • ECOSYSTEM: < 9.0.58-1ubuntu0.1+esm4

    Update to 9.0.58-1ubuntu0.1+esm4

Original sources

Check your server →