PT-2023-5210 · Apache+5 · Apache Tomcat Connectors+5

Karl Von Randow · Published 2023-09-11 · Updated 2025-01-14 · CVE-2023-41081

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat Connectors versions 1.2.0 through 1.2.48

Description The mod jk component of Apache Tomcat Connectors is affected by an issue where, in certain circumstances, such as when a configuration includes "JkOptions +ForwardDirectories" but does not provide explicit mounts for all possible proxied requests, mod jk would use an implicit mapping and map the request to the first defined worker. This could result in the unintended exposure of the status worker and/or bypass security constraints configured in httpd. The issue is resolved in version 1.2.49, where the implicit mapping functionality has been removed, and all mappings must now be via explicit configuration.

Recommendations Upgrade to version 1.2.49, which fixes the issue.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

ALSA-2024:2387

BDU:2023-05818

CVE-2023-41081

DLA-3580-1

INFSA-2024_2387

MGASA-2024-0130

OPENSUSE-SU-2025_0102-1

RHSA-2023:7625

RHSA-2024:2387

RHSA-2024_2387

SUSE-SU-2024:1198-1

SUSE-SU-2024_1198-1

SUSE-SU-2025:0102-1

SUSE-SU-2025_0102-1

USN-6826-1

Affected Products

Almalinux

Apache Tomcat Connectors

Linuxmint

Red Hat

Suse

Ubuntu

References · 71

• https://osv.dev/vulnerability/MGASA-2024-0130 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3580-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6826-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2024-0130.html · Security Note
• https://security-tracker.debian.org/tracker/CVE-2023-41081 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-41081 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-41081 · Security Note
• https://lists.apache.org/thread/rd1r26w7271jyqgzr4492tooyt583d8b · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-41081 · Security Note
• https://bdu.fstec.ru/vul/2023-05818 · Security Note
• https://osv.dev/vulnerability/ALSA-2024:2387 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2024-2387.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-41081 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6710 · Security Note
• https://security-tracker.debian.org/tracker/DLA-3580-1 · Vendor Advisory