FKIE_CVE-2023-41081

Vulnerability from fkie_nvd - Published: 2023-09-13 10:15 - Updated: 2026-06-17 06:20
Severity
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
Important: Authentication Bypass CVE-2023-41081 The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included "JkOptions +ForwardDirectories" but the configuration did not provide explicit mounts for all possible proxied requests, mod_jk would use an implicit mapping and map the request to the first defined worker. Such an implicit mapping could result in the unintended exposure of the status worker and/or bypass security constraints configured in httpd. As of JK 1.2.49, the implicit mapping functionality has been removed and all mappings must now be via explicit configuration. Only mod_jk is affected by this issue. The ISAPI redirector is not affected. This issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48. Users are recommended to upgrade to version 1.2.49, which fixes the issue. History 2023-09-13 Original advisory 2023-09-28 Updated summary
References
security@apache.orghttp://www.openwall.com/lists/oss-security/2023/09/28/7
security@apache.orghttps://lists.apache.org/thread/rd1r26w7271jyqgzr4492tooyt583d8bMailing List
security@apache.orghttps://lists.debian.org/debian-lts-announce/2023/09/msg00027.html
security@apache.orghttps://www.openwall.com/lists/oss-security/2023/09/13/2
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2023/09/28/7
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread/rd1r26w7271jyqgzr4492tooyt583d8bMailing List
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2023/09/msg00027.html
af854a3a-2127-422b-91ae-364da2661108https://www.openwall.com/lists/oss-security/2023/09/13/2
Impacted products
Vendor Product Version
apache tomcat_connectors *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat Connectors",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "1.2.48",
              "status": "affected",
              "version": "1.2.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@apache.org"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:apache:tomcat_connectors:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "tomcat_connectors",
          "vendor": "apache",
          "versions": [
            {
              "lessThanOrEqual": "1.2.48",
              "status": "affected",
              "version": "1.2.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:tomcat_connectors:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9349521D-9E00-44E9-A1FF-E12C299CFEFA",
              "versionEndExcluding": "1.2.49",
              "versionStartIncluding": "1.2.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Important: Authentication Bypass CVE-2023-41081\n\nThe mod_jk component of Apache Tomcat Connectors\u00a0in some circumstances, such as when a configuration included\u00a0\"JkOptions +ForwardDirectories\" but the configuration did not       provide explicit mounts for all possible proxied requests, mod_jk would       use an implicit mapping and map the request to the first defined worker.\u00a0Such an implicit mapping could result in the unintended exposure of the\u00a0status worker and/or bypass security constraints configured in httpd. As\u00a0of JK 1.2.49, the implicit mapping functionality has been removed and all\u00a0mappings must now be via explicit configuration.\u00a0Only mod_jk is affected\u00a0by this issue. The ISAPI redirector is not affected.\n\nThis issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48.\n\nUsers are recommended to upgrade to version 1.2.49, which fixes the issue.\n\nHistory\n2023-09-13 Original advisory\n\n2023-09-28 Updated summary\n\n"
    },
    {
      "lang": "es",
      "value": "Importante: Omisi\u00f3n de Autenticaci\u00f3n CVE-2023-41081. El componente mod_jk de Apache Tomcat Connectors en algunas circunstancias, como cuando una configuraci\u00f3n inclu\u00eda \"JkOptions +ForwardDirectories\" pero la configuraci\u00f3n no proporcionaba mounts expl\u00edcitos para todas las posibles solicitudes de proxy, mod_jk usar\u00eda un mapeo impl\u00edcito y mapear\u00eda la solicitud al primer worker definido. Un mapeo impl\u00edcito de este tipo podr\u00eda dar como resultado la exposici\u00f3n no deseada del estado del worker y/o eludir las restricciones de seguridad configuradas en httpd. A partir de JK 1.2.49, la funcionalidad de asignaci\u00f3n impl\u00edcita se elimin\u00f3 y todas las asignaciones ahora deben realizarse mediante una configuraci\u00f3n expl\u00edcita. S\u00f3lo mod_jk se ve afectado por este problema. El redirector ISAPI no se ve afectado. Este problema afecta a los conectores Apache Tomcat (solo mod_jk): desde la versi\u00f3n 1.2.0 hasta la 1.2.48. Se recomienda a los usuarios actualizar a la versi\u00f3n 1.2.49, que soluciona el problema. Historia: 2023-09-13. Aviso original: 2023-09-28. Resumen actualizado"
    }
  ],
  "id": "CVE-2023-41081",
  "lastModified": "2026-06-17T06:20:28.770",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-41081",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-09-25T17:18:39.972078Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2023-09-13T10:15:07.657",
  "references": [
    {
      "source": "security@apache.org",
      "url": "http://www.openwall.com/lists/oss-security/2023/09/28/7"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Mailing List"
      ],
      "url": "https://lists.apache.org/thread/rd1r26w7271jyqgzr4492tooyt583d8b"
    },
    {
      "source": "security@apache.org",
      "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00027.html"
    },
    {
      "source": "security@apache.org",
      "url": "https://www.openwall.com/lists/oss-security/2023/09/13/2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2023/09/28/7"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List"
      ],
      "url": "https://lists.apache.org/thread/rd1r26w7271jyqgzr4492tooyt583d8b"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00027.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.openwall.com/lists/oss-security/2023/09/13/2"
    }
  ],
  "sourceIdentifier": "security@apache.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.