CVE-2023-41080:
Apache Tomcat Open Redirect vulnerability
6.1
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.93126%
CWE
Published
8/25/2023
Updated
11/11/2023
KEV Status
No
Technology
Java
JavaTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.tomcat:tomcat | maven | >= 11.0.0-M1, < 11.0.0-M11 | 11.0.0-M11 |
| org.apache.tomcat:tomcat | maven | >= 10.1.0-M1, < 10.1.13 | 10.1.13 |
| org.apache.tomcat:tomcat | maven | >= 9.0.0-M1, < 9.0.80 | 9.0.80 |
| org.apache.tomcat:tomcat | maven | >= 8.5.0, < 8.5.93 | 8.5.93 |
| org.apache.tomcat.embed:tomcat-embed-core | maven | >= 8.5.0, < 8.5.93 | 8.5.93 |
| org.apache.tomcat.embed:tomcat-embed-core | maven | >= 9.0.0-M1, < 9.0.80 | 9.0.80 |
| org.apache.tomcat.embed:tomcat-embed-core | maven | >= 10.1.0-M1, < 10.1.13 | 10.1.13 |
| org.apache.tomcat.embed:tomcat-embed-core | maven | >= 11.0.0-M1, < 11.0.0-M11 | 11.0.0-M11 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from how FORM authentication handles redirects. The commit diff shows a critical modification in FormAuthenticator.java's savedRequestURL method where a loop was added to strip leading slashes to prevent protocol-relative redirects. Prior to this fix, the method would return URLs like '//evil.com' when reconstructing the saved request URL from session data, which browsers interpret as a protocol-relative URL inheriting the current scheme (HTTP/HTTPS). This matches the CWE-601 description of open redirects via unvalidated URLs.