~ / search / GHSA-q3mw-pvr8-9ggc

GHSA-q3mw-pvr8-9ggc

Apache Tomcat Open Redirect vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-41080

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.tomcat:tomcat >= 11.0.0-M1, < 11.0.0-M11 11.0.0-M11
Maven org.apache.tomcat:tomcat >= 10.1.0-M1, < 10.1.13 10.1.13
Maven org.apache.tomcat:tomcat >= 9.0.0-M1, < 9.0.80 9.0.80
Maven org.apache.tomcat:tomcat >= 8.5.0, < 8.5.93 8.5.93
Maven org.apache.tomcat.embed:tomcat-embed-core >= 8.5.0, < 8.5.93 8.5.93
Maven org.apache.tomcat.embed:tomcat-embed-core >= 9.0.0-M1, < 9.0.80 9.0.80
Maven org.apache.tomcat.embed:tomcat-embed-core >= 10.1.0-M1, < 10.1.13 10.1.13
Maven org.apache.tomcat.embed:tomcat-embed-core >= 11.0.0-M1, < 11.0.0-M11 11.0.0-M11
Maven org.apache.tomcat:tomcat-catalina >= 10.1.0-M1, < 10.1.13 10.1.13
Maven org.apache.tomcat:tomcat-catalina >= 9.0.0-M1, < 9.0.80 9.0.80
Maven org.apache.tomcat:tomcat-catalina >= 8.5.0, < 8.5.93 8.5.93

Details

As written in the advisory (Markdown source, shown as plain text).

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. Older, EOL versions may also be affected. The vulnerability is limited to the ROOT (default) web application.

References

External links from the advisory. They lead to third-party sites.