CVE-2023-41081 Apache Tomcat Connectors: Unexpected use of first declared worker in mod_jk for unmapped request

🗓️ 13 Sep 2023 09:30:05Reported by GoogleType

osv

osv🔗 osv.dev👁 7 Views

Authentication bypass in Apache Tomcat Connectors mod_jk fixed in version 1.2.49.

Reporter	Title	Published	Views	Family All 55
AlmaLinux	Moderate: mod_jk and mod_proxy_cluster security update	30 Apr 202400:00	–	almalinux
BDU FSTEC	The vulnerability of the JkOptions+ForwardDirectories configuration in the mod_jk module of the server modules for connecting applications like Tomcat and Apache Tomcat Connectors allows attackers to circumvent security restrictions and gain unauthorized access to protected information.	19 Sep 202300:00	–	bdu_fstec
Circl	CVE-2023-41081	13 Sep 202314:23	–	circl
CNNVD	Apache Tomcat Security Vulnerability	13 Sep 202300:00	–	cnnvd
CVE	CVE-2023-41081	13 Sep 202309:30	–	cve
Cvelist	CVE-2023-41081 Apache Tomcat Connectors: Unexpected use of first declared worker in mod_jk for unmapped request	13 Sep 202309:30	–	cvelist
Debian	[SECURITY] [DLA 3580-1] libapache-mod-jk security update	24 Sep 202317:22	–	debian
Debian CVE	CVE-2023-41081	13 Sep 202309:30	–	debiancve
Tenable Nessus	Debian dla-3580 : libapache-mod-jk-doc - security update	25 Sep 202300:00	–	nessus
Tenable Nessus	MiracleLinux 9 : mod_jk-1.2.49-1.el9, mod_proxy_cluster-1.3.20-1.el9 (AXSA:2024-7930:01)	20 Jan 202600:00	–	nessus

Source	Link
openwall	www.openwall.com/lists/oss-security/2023/09/28/7
lists	www.lists.debian.org/debian-lts-announce/2023/09/msg00027.html
openwall	www.openwall.com/lists/oss-security/2023/09/13/2
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41081.json
lists	www.lists.apache.org/thread/rd1r26w7271jyqgzr4492tooyt583d8b
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-41081

15 Jul 2026 01:49Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.17.5

EPSS0.01257

authentication bypass issue apache tomcat connectors mod_jk component version update security exposure.