CVE-2023-41081 Apache Tomcat Connectors: Unexpected use of first declared worker in mod_jk for unmapped request

🗓️ 13 Sep 2023 09:30:05Reported by apacheType

Apache Tomcat Connectors: Unexpected use of first declared worker in mod_jk for unmapped request, Authentication Bypass CVE-2023-4108

Reporter	Title	Published	Views	Family All 52
AlmaLinux	Moderate: mod_jk and mod_proxy_cluster security update	30 Apr 202400:00	–	almalinux
BDU FSTEC	The vulnerability of the JkOptions+ForwardDirectories configuration in the mod_jk module of the server modules for connecting applications like Tomcat and Apache Tomcat Connectors allows attackers to circumvent security restrictions and gain unauthorized access to protected information.	19 Sep 202300:00	–	bdu_fstec
Circl	CVE-2023-41081	13 Sep 202314:23	–	circl
CNNVD	Apache Tomcat Security Vulnerability	13 Sep 202300:00	–	cnnvd
CVE	CVE-2023-41081	13 Sep 202309:30	–	cve
Debian	[SECURITY] [DLA 3580-1] libapache-mod-jk security update	24 Sep 202317:22	–	debian
Debian CVE	CVE-2023-41081	13 Sep 202309:30	–	debiancve
Tenable Nessus	Debian dla-3580 : libapache-mod-jk-doc - security update	25 Sep 202300:00	–	nessus
Tenable Nessus	MiracleLinux 9 : mod_jk-1.2.49-1.el9, mod_proxy_cluster-1.3.20-1.el9 (AXSA:2024-7930:01)	20 Jan 202600:00	–	nessus
Tenable Nessus	Oracle Linux 9 : mod_jk / and / mod_proxy_cluster (ELSA-2024-2387)	6 May 202400:00	–	nessus

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Tomcat Connectors",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "1.2.48",
        "status": "affected",
        "version": "1.2.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
lists	www.lists.debian.org/debian-lts-announce/2023/09/msg00027.html
openwall	www.openwall.com/lists/oss-security/2023/09/28/7
lists	www.lists.apache.org/thread/rd1r26w7271jyqgzr4492tooyt583d8b
openwall	www.openwall.com/lists/oss-security/2023/09/13/2

28 Sep 2023 21:30Current

7.9High risk

Vulners AI Score7.9

EPSS0.01257