Apache Tomcat mod_jk Connector: Schwachstelle ermöglicht Umgehung von Sicherheitsmaßnahmen oder Offenlegung von Informationen
WID-SEC-2023-2337 · first 13.09.2023 · updated 24.07.2026 · CVSS 7,5
What it is about
Apache Tomcat ist ein Web-Applikationsserver für verschiedene Plattformen. Ein entfernter anonymer Angreifer kann eine Schwachstelle in Apache Tomcat mod_jk Connector ausnutzen, um Sicherheitsmaßnahmen zu umgehen oder vertrauliche Informationen offenzulegen.
Under what conditions?
Over the network.
What can happen in the worst case
An attacker could use the vulnerability to
- Sicherheitsmaßnahmen zu umgehen oder vertrauliche Informationen offenzulegen
Am I affected?
Affected according to the BSI:
- Debian Linux
- Red Hat JBoss Core Services 1
- Ubuntu Linux
- SUSE Linux
- Red Hat JBoss Core Services
- EMC Avamar
- Dell NetWorker
- Apache Tomcat Connector (mod_jk) <1.2.49
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Apache Tomcat Connector (mod_jk) 1.2.49
Is the vulnerability already being exploited?
None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.
Information and sources
- Original BSI advisory (WID)
- Apache Security Notification vom 2023-09-12 seclists.org
- Debian Security Advisory DLA-3580 vom 2023-09-24 lists.debian.org
- Red Hat Security Advisory RHSA-2023:7626 vom 2023-12-07 access.redhat.com
- Red Hat Security Advisory RHSA-2023:7625 vom 2023-12-07 access.redhat.com
- SUSE Security Update SUSE-SU-2024:1198-1 vom 2024-04-10 lists.suse.com
- Ubuntu Security Notice USN-6826-1 vom 2024-06-11 ubuntu.com
- Dell Security Advisory DSA-2024-348 vom 2024-08-06 www.dell.com
- SUSE Security Update SUSE-SU-2025:0102-1 vom 2025-01-14 lists.suse.com
- Ubuntu Security Notice USN-8369-2 vom 2026-07-23 ubuntu.com
CVE: CVE-2023-41081
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.