Riskcovery

CVE-2023-41080

Apache Tomcat: Open redirect with FORM authentication

State
Published
Severity
Not scored
Published
Aug 25, 2023
Updated
Oct 29, 2025
Reserved
Aug 22, 2023

Read the record on cve.org

Description

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. Older, EOL versions may also be affected.

The vulnerability is limited to the ROOT (default) web application.

Scores

The record has no CVSS score.

Weaknesses

  • CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

Affected Products

ProductVersions
Apache TomcatApache Software Foundation
  • 11.0.0-M1 through 11.0.0-M10Affected
  • 10.1.0-M1 through 10.0.12Affected
  • 9.0.0-M1 through 9.0.79Affected
  • 8.5.0 through 8.5.92Affected
  • 3 to before 8.5.0Unknown
  • 10.0.0-M1 through 10.0.27Unknown

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.