CVE-2023-41081

Important: Authentication Bypass CVE-2023-41081 The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included "JkOptions +ForwardDirectories" but the configuration did not provide explicit mounts for all possible proxied requests, mod_jk would use an implicit mapping and map the request to the first defined worker. Such an implicit mapping could result in the unintended exposure of the status worker and/or bypass security constraints configured in httpd. As of JK 1.2.49, the implicit mapping functionality has been removed and all mappings must now be via explicit configuration. Only mod_jk is affected by this issue. The ISAPI redirector is not affected. This issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48. Users are recommended to upgrade to version 1.2.49, which fixes the issue. History 2023-09-13 Original advisory 2023-09-28 Updated summary

• http://www.openwall.com/lists/oss-security/2023/09/28/7
• https://lists.apache.org/thread/rd1r26w7271jyqgzr4492tooyt583d8bMailing List
• https://lists.debian.org/debian-lts-announce/2023/09/msg00027.html
• https://www.openwall.com/lists/oss-security/2023/09/13/2
• http://www.openwall.com/lists/oss-security/2023/09/28/7
• https://lists.apache.org/thread/rd1r26w7271jyqgzr4492tooyt583d8bMailing List
• https://lists.debian.org/debian-lts-announce/2023/09/msg00027.html
• https://www.openwall.com/lists/oss-security/2023/09/13/2

Published

Sep 13, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-41076An app may be able to elevate privileges. This issue is fixe…7.3
• CVE-2023-41077An app may be able to access protected user data. This issue…5.5
• CVE-2023-41078An authorization issue was addressed with improved state man…5.5
• CVE-2023-41079The issue was addressed with improved permissions logic. Thi…5.5
• CVE-2023-4108Mattermost fails to sanitize post metadata during audit logg…7.5
• CVE-2023-41080URL Redirection to Untrusted Site ('Open Redirect') vulnerab…6.1
• CVE-2023-41082Null pointer dereference for some Intel(R) CST software befo…4.4
• CVE-2023-41084 Session management within the web application is …9.8
• CVE-2023-41085 When IPSec is configured on a Virtual Server, undisclosed t…7.5
• CVE-2023-41086Cross-site request forgery (CSRF) vulnerability exists in FU…8.8
• CVE-2023-41088 The affected product is vulnerable to a cleartext…6.5
• CVE-2023-41089 The affected product is vulnerable to an improper a…8.8