CVE-2023-41080
MediumCVSS 6.1Exploitation Probability (EPSS)
Very high risk92th percentile - higher than 92% of all known CVEs
Summary
The 'Open Redirect' vulnerability in the FORM authentication feature of Apache Tomcat allows redirecting users to untrusted sites. This affects Apache Tomcat versions from 11.0.0-M1 to 11.0.0-M10, from 10.1.0-M1 to 10.0.12, from 9.0.0-M1 to 9.0.79, and from 8.5.0 to 8.5.92.
Risk Assessment
An attacker could exploit this vulnerability to trick users into visiting malicious sites, potentially leading to data theft or malware.
Recommendation
It is recommended to update Apache Tomcat to the latest version to mitigate this vulnerability and to monitor the application for potential exploitation attempts.
Original NVD description (English source)
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. Older, EOL versions may also be affected. The vulnerability is limited to the ROOT (default) web application.