Unrated
Apache Tomcat: Open redirect with FORM authentication
Type: advisorySources: OSV
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. Older, EOL versions may also be affected. The vulnerability is limited to the ROOT (default) web application.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2023-41080
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 7 Nov 2026, 07:04 UTC · Revision 1
Source evidence
Apache Tomcat: Open redirect with FORM authentication
core-osv · Original sourcePublished 25 Aug 2023, 20:39 UTC
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. Older, EOL versions may also be affected. The vulnerability is limited to the ROOT (default) web application.
osv:CVE-2023-41080
Complete source record
{
"id": "0ccdaa4dca222ca3758ff4f3f53175b1bb3f0f2e2b2e6f985c3fe64ff1d038a4",
"url": "https://osv.dev/vulnerability/CVE-2023-41080",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Apache Tomcat: Open redirect with FORM authentication",
"summary": "URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. Older, EOL versions may also be affected. The vulnerability is limited to the ROOT (default) web application.",
"evidence": "osv:CVE-2023-41080",
"products": [],
"severity": "unknown",
"structured": {
"id": "CVE-2023-41080",
"aliases": [
"BIT-tomcat-2023-41080",
"CVE-2023-41080",
"GHSA-q3mw-pvr8-9ggc"
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/apache/tomcat",
"type": "GIT",
"events": [
{
"introduced": "e37b977db6f47e4380ad67114a49e8568951c953"
},
{
"last_affected": "90f385149d4c1492e7d50412b19b9fad55bd70a9"
},
{
"introduced": "16bf392c67833ad549733b58c350ff92b5ee782a"
},
{
"last_affected": "a4bbc1f1676932460f993653c04ec43a1e9e8c88"
},
{
"introduced": "e9d17cddc285615807ec5fef09240777436b25dc"
},
{
"last_affected": "fb24d1d6525c774f27c3f711c52790552ee389ee"
},
{
"introduced": "59c81e30e2f64f5e8c1db78c4860c51850dfb0bd"
},
{
"last_affected": "de714a23642a4d0baef342db6762a7f7a550d82c"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "8.5.0"
},
{
"last_affected": "8.5.92"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0"
},
{
"last_affected": "9.0.79"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "10.1.0"
},
{
"last_affected": "10.1.12"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone1:*:*:*:*:*:*",
"range": [
{
"introduced": "11.0.0-milestone1"
},
{
"last_affected": "11.0.0-milestone1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone10:*:*:*:*:*:*",
"range": [
{
"introduced": "11.0.0-milestone10"
},
{
"last_affected": "11.0.0-milestone10"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone2:*:*:*:*:*:*",
"range": [
{
"introduced": "11.0.0-milestone2"
},
{
"last_affected": "11.0.0-milestone2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone3:*:*:*:*:*:*",
"range": [
{
"introduced": "11.0.0-milestone3"
},
{
"last_affected": "11.0.0-milestone3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone4:*:*:*:*:*:*",
"range": [
{
"introduced": "11.0.0-milestone4"
},
{
"last_affected": "11.0.0-milestone4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone5:*:*:*:*:*:*",
"range": [
{
"introduced": "11.0.0-milestone5"
},
{
"last_affected": "11.0.0-milestone5"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone6:*:*:*:*:*:*",
"range": [
{
"introduced": "11.0.0-milestone6"
},
{
"last_affected": "11.0.0-milestone6"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone7:*:*:*:*:*:*",
"range": [
{
"introduced": "11.0.0-milestone7"
},
{
"last_affected": "11.0.0-milestone7"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone8:*:*:*:*:*:*",
"range": [
{
"introduced": "11.0.0-milestone8"
},
{
"last_affected": "11.0.0-milestone8"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone9:*:*:*:*:*:*",
"range": [
{
"introduced": "11.0.0-milestone9"
},
{
"last_affected": "11.0.0-milestone9"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"11.0.0-milestone1",
"11.0.0-milestone10",
"11.0.0-milestone2",
"11.0.0-milestone3",
"11.0.0-milestone4",
"11.0.0-milestone5",
"11.0.0-milestone6",
"11.0.0-milestone7",
"11.0.0-milestone8",
"11.0.0-milestone9"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-41080.json"
}
}
],
"modified": "2026-10-28T02:30:50.056475848Z",
"provider": "osv",
"references": [
"https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41080.json",
"https://lists.apache.org/thread/71wvwprtx2j2m54fovq9zr7gbm2wow2f",
"https://nvd.nist.gov/vuln/detail/CVE-2023-41080",
"https://security.netapp.com/advisory/ntap-20230921-0006/",
"https://www.debian.org/security/2023/dsa-5521",
"https://www.debian.org/security/2023/dsa-5522"
],
"provider_metadata": {
"cwe_ids": [
"CWE-601"
],
"cna_assigner": "apache",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"introduced": "11.0.0-M1"
},
{
"last_affected": "11.0.0-M10"
},
{
"introduced": "10.1.0-M1"
},
{
"last_affected": "10.0.12"
},
{
"introduced": "9.0.0-M1"
},
{
"last_affected": "9.0.79"
},
{
"introduced": "8.5.0"
},
{
"last_affected": "8.5.92"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41080.json"
}
},
"related_cves": [
{
"value": "CVE-2023-41080",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 518586,
"published_at": "2023-08-25T20:39:36.584+00:00"
}