CVE-2023-41080

Опубликовано: 25 авг. 2023

Источник: nvd

CVSS3: 6.1

EPSS Средний

Описание

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92.

The vulnerability is limited to the ROOT (default) web application.

Ссылки

https://lists.apache.org/thread/71wvwprtx2j2m54fovq9zr7gbm2wow2f
Issue Tracking
Patch
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html
Mailing List
Third Party Advisory
https://security.netapp.com/advisory/ntap-20230921-0006/
Third Party Advisory
https://www.debian.org/security/2023/dsa-5521
Third Party Advisory
https://www.debian.org/security/2023/dsa-5522
Third Party Advisory
https://lists.apache.org/thread/71wvwprtx2j2m54fovq9zr7gbm2wow2f
Issue Tracking
Patch
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html
Mailing List
Third Party Advisory
https://security.netapp.com/advisory/ntap-20230921-0006/
Third Party Advisory
https://www.debian.org/security/2023/dsa-5521
Third Party Advisory
https://www.debian.org/security/2023/dsa-5522
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

Версия от 8.5.0 (включая) до 8.5.92 (включая)

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

Версия от 9.0.0 (включая) до 9.0.79 (включая)

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

Версия от 10.1.0 (включая) до 10.1.12 (включая)

cpe:2.3:a:apache:tomcat:11.0.0:milestone1:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone10:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone2:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone3:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone4:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone5:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone6:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone7:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone8:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone9:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

EPSS

Процентиль: 93%

0.11116

Средний

6.1 Medium

CVSS3

Дефекты

CWE-601

Связанные уязвимости

CVE-2023-41080

CVSS3: 6.1

ubuntu

почти 2 года назад

CVE-2023-41080

CVSS3: 6.1

redhat

почти 2 года назад

CVE-2023-41080

CVSS3: 6.1

debian

почти 2 года назад

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in F ...

SUSE-SU-2023:3987-1

suse-cvrf

больше 1 года назад

Security update for tomcat

GHSA-q3mw-pvr8-9ggc

CVSS3: 6.1

github

почти 2 года назад

Apache Tomcat Open Redirect vulnerability

EPSS

Процентиль: 93%

0.11116

Средний

6.1 Medium

CVSS3

Дефекты

CWE-601