Read the docs
TI-2023-21705 Aliases CVE-2023-41081GHSA-4wvr-fq5p-2362

Apache Tomcat Connectors: Unexpected use of first declared worker in mod_jk for unmapped request

Priority MEDIUM 42Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 4 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.

Summary

Important: Authentication Bypass CVE-2023-41081 The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included "JkOptions +ForwardDirectories" but the configuration did not provide explicit mounts for all possible proxied requests, mod_jk would use an implicit mapping and map the request to the first defined worker. Such an implicit mapping could result in the unintended exposure of the status worker and/or bypass security constraints configured in httpd. As of JK 1.2.49, the implicit mapping functionality has been removed and all mappings must now be via explicit configuration. Only mod_jk is affected by this issue. The ISAPI redirector is not affected. This issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48. Users are recommended to upgrade to version 1.2.49, which fixes the issue. History 2023-09-13 Original advisory 2023-09-28 Updated summary

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01589 75th percentileScored 2026-11-07
Fix Partial Red Hat: 3 advisoriesRed Hat: 4 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Tomcat Connectors1.2.0 – 1.2.48—No fix listedCNA
  • Apache Tomcat Connectors VendorApache Affected 1.2.0 – 1.2.48 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat_connectors:*:*:*:*:*:*:*:*1.2.0 to before 1.2.49VulnerableApache
  • cpe:2.3:a:apache:tomcat_connectors:*:*:*:*:*:*:*:* Versions 1.2.0 to before 1.2.49 Vulnerable ·Apache

Remediation

Red Hat 3 advisories

  • RHSA-2024:2387 Released 2024-04-30 · Red Hat rating Moderate
    mod_jk and mod_proxy_cluster security update
    • Red Hat Enterprise Linux AppStream (v. 9) mod_jk-1.2.49-1.el9_4, mod_proxy_cluster-1.3.20-1.el9_4
  • RHSA-2023:7626 Released 2023-12-07 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP2 security update
    • Red Hat JBoss Core Services
  • RHSA-2023:7625 Released 2023-12-07 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP2 security update
    • Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-curl-8.4.0-2.el7jbcs, jbcs-httpd24-libcurl-8.4.0-2.el7jbcs, jbcs-httpd24-libcurl-devel-8.4.0-2.el7jbcs +8
    • Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-curl-8.4.0-2.el8jbcs, jbcs-httpd24-libcurl-8.4.0-2.el8jbcs, jbcs-httpd24-libcurl-devel-8.4.0-2.el8jbcs +8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:2387
Red Hat JBoss Core ServicesFixed RHSA-2023:7626
Red Hat JBoss Core Services on RHEL 7 ServerFixed RHSA-2023:7625
Red Hat JBoss Core Services on RHEL 8Fixed RHSA-2023:7625
Not affected: 3 products
  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat JBoss Core Services on RHEL 7 Server
  • Red Hat JBoss Core Services on RHEL 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-41081
  2. 2026-10-03 Alias added: GHSA-4wvr-fq5p-2362
  3. 2026-10-09 Fix available: RHSA-2023:7626 · Red Hat
  4. 2026-10-31 Fix available: Red Hat JBoss Core Services · Red Hat

References

Advisory 1

Other 3

  • TI-2014-06727 Apache Tomcat Connectors (mod_jk) before 1.2.41 ignores JkUnmount rules for subtrees of… CVSS 2.0MEDIUM 5.0
  • TI-2024-31014 Apache Tomcat Connectors: mod_jk: local users can view and modify configuration CVSS 3.1MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences