7.5

CVE-2023-41081: apache software foundation apache tomcat connectors

CVSS: 7.5v3.1HighModified
AliasesMGASA-2024-0130SUSE-SU-2024:1198-1UBUNTU-CVE-2023-41081
Published 13-09-2023Last modified 25-09-2024
Open JSON

Vulnerability summary

CVE-2023-41081 is a high (CVSS 7.5) vulnerability in apache software foundation apache tomcat connectors. EPSS estimates a 1.59% chance of exploitation in the next 30 days, higher than 75.2% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
1.59%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3 · Related 1
RHSA-2023:7625RHSA-2024:2387SUSE-SU-2025:0102-1

Timeline

  1. 13-09-2023
    PublishedVulnerability first disclosed.
  2. 25-09-2024
    Last modifiedVulnerability information updated.

Description

Important: Authentication Bypass CVE-2023-41081 The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included "JkOptions +ForwardDirectories" but the configuration did not provide explicit mounts for all possible proxied requests, mod_jk would use an implicit mapping and map the request to the first defined worker. Such an implicit mapping could result in the unintended exposure of the status worker and/or bypass security constraints configured in httpd. As of JK 1.2.49, the implicit mapping functionality has been removed and all mappings must now be via explicit configuration. Only mod_jk is affected by this issue. The ISAPI redirector is not affected. This issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48. Users are recommended to upgrade to version 1.2.49, which fixes the issue. History 2023-09-13 Original advisory 2023-09-28 Updated summary

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

1.59%

Chance of exploitation in the next 30 days

Percentile

75%

Versus all other CVEs

30-day change

0.00 pp

From 1.59% on 19-09-2026

19-09-202619-10-2026
EPSS score
1.59%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Suse2 products
  • apache2-mod_jk&distro=SUSE Linux Enterprise Server 12 SP5< 1.2.49-7.9.1
  • apache2-mod_jk&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 1.2.49-7.9.1
Apache1 product
Apache software foundation1 product
Debian1 product
  • libapache-mod-jk< 1:1.2.48-2+deb12u1 | < 1:1.2.49-1 | < 1:1.2.46-1+deb10u2
Mageia1 product
  • apache-mod_jk< 1.2.49-1.mga9
Ubuntu1 product
  • libapache-mod-jk< 1:1.2.41-1ubuntu0.1~esm1 | < 1:1.2.43-1ubuntu0.1~esm1 | < 1:1.2.46-1ubuntu0.1 | < 1:1.2.48-1ubuntu0.1 | < 1:1.2.41-1ubuntu0.1~esm2

6 vendors · 7 products

References

20 links
Show all 20 references