Cyber Resilience

CVE-2023-41080

Medium

Published: 25 August 2023

Published
25 August 2023
Modified
07 August 2025
KEV Added
—
Patch
—
CVSS Score v3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS Score 0.1159 93.8th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-41080 is a medium-severity Open Redirect (CWE-601) vulnerability in Apache Tomcat. Its CVSS base score is 6.1 (Medium).

Operationally, ranked in the top 6.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

CVE-2023-41080 is an open redirect vulnerability (CWE-601) in the FORM authentication feature of Apache Tomcat. It affects the ROOT web application in versions 11.0.0-M1 through 11.0.0-M10, 10.1.0-M1 through 10.0.12, 9.0.0-M1 through 9.0.79, and 8.5.0 through 8.5.92, with older end-of-life releases also potentially impacted. The issue carries a CVSS 3.1 score of 6.1.

An unauthenticated remote attacker can supply a crafted URL that triggers an open redirect during FORM-based login handling, allowing the victim to be sent to an untrusted site under attacker control and enabling phishing or further client-side attacks.

Advisories from Apache, Debian, and NetApp recommend upgrading Tomcat to fixed releases and note that the vulnerability is confined to the default ROOT application; the referenced lists detail the specific patched versions and backports available for supported branches.

EPSS for this CVE rose from a low baseline to a peak of 0.1366 (current value 0.1159), indicating emerging exploitation interest after disclosure.

EU & UK References

Vulnerability details

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. Older, EOL versions may also…

more

be affected. The vulnerability is limited to the ROOT (default) web application.

CWE(s)
CWE-601

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

apache
tomcat
11.0.0 · 8.5.0 — 8.5.92 · 9.0.0 — 9.0.79 · 10.1.0 — 10.1.12
debian
debian linux
10.0, 11.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AT-2 Literacy Training and Awareness
addresses: CWE-601

Security awareness includes verifying URLs and avoiding untrusted redirects that lead to malicious sites.

SI-10 Information Input Validation
addresses: CWE-601

Validates redirect targets and URLs to ensure they conform to allowed destinations.

References