Important: Authentication Bypass CVE-2023-41081 The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included "JkOptions +ForwardDirectories" but the configuration did not provide explicit mounts for all possible proxied requests, mod_jk would use an implicit mapping and map the request to the first defined worker. Such an implicit mapping could result in the unintended exposure of the status worker and/or bypass security constraints configured in httpd. As of JK 1.2.49, the implicit mapping functionality has been removed and all mappings must now be via explicit configuration. Only mod_jk is affected by this issue. The ISAPI redirector is not affected. This issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48. Users are recommended to upgrade to version 1.2.49, which fixes the issue. History 2023-09-13 Original advisory 2023-09-28 Updated summary

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 host has a package installed that is affected by a vulnerability as referenced in the USN-6826-1 advisory.

    Karl von Randow discovered that mod_jk was vulnerable to an authentication bypass. If the configuration     did not provide explicit mounts for all possible proxied requests, an attacker could possibly use this

    vulnerability to bypass security constraints configured in httpd.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2387 advisory.

  - A flaw was found in the mod_proxy_cluster in the Apache server. This issue may allow a malicious user to     add a script in the 'alias' parameter in the URL to trigger the stored cross-site scripting (XSS)     vulnerability. By adding a script on the alias parameter on the URL, it adds a new virtual host and adds     the script to the cluster-manager page. (CVE-2023-6710)

  - Important: Authentication Bypass CVE-2023-41081 The mod_jk component of Apache Tomcat Connectors in some     circumstances, such as when a configuration included JkOptions +ForwardDirectories but the configuration     did not provide explicit mounts for all possible proxied requests, mod_jk would use an implicit mapping     and map the request to the first defined worker. Such an implicit mapping could result in the unintended     exposure of the status worker and/or bypass security constraints configured in httpd. As of JK 1.2.49, the     implicit mapping functionality has been removed and all mappings must now be via explicit configuration.
    Only mod_jk is affected by this issue. The ISAPI redirector is not affected. This issue affects Apache     Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48. Users are recommended to upgrade to version     1.2.49, which fixes the issue. History 2023-09-13 Original advisory 2023-09-28 Updated summary     (CVE-2023-41081)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2387 advisory.

    The mod_jk module is a plugin for the Apache HTTP Server to connect it with the Apache Tomcat servlet     engine.

    The mod_proxy_cluster module is a plugin for the Apache HTTP Server that provides load-balancer     functionality.

    Security Fix(es):

    * httpd: Apache Tomcat Connectors (mod_jk) Information Disclosure (CVE-2023-41081)

    * mod_cluster/mod_proxy_cluster: Stored Cross site Scripting (CVE-2023-6710)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:1198-1 advisory.

  - Important: Authentication Bypass CVE-2023-41081 The mod_jk component of Apache Tomcat Connectors in some     circumstances, such as when a configuration included JkOptions +ForwardDirectories but the configuration     did not provide explicit mounts for all possible proxied requests, mod_jk would use an implicit mapping     and map the request to the first defined worker. Such an implicit mapping could result in the unintended     exposure of the status worker and/or bypass security constraints configured in httpd. As of JK 1.2.49, the     implicit mapping functionality has been removed and all mappings must now be via explicit configuration.
    Only mod_jk is affected by this issue. The ISAPI redirector is not affected. This issue affects Apache     Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48. Users are recommended to upgrade to version     1.2.49, which fixes the issue. History 2023-09-13 Original advisory 2023-09-28 Updated summary     (CVE-2023-41081)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7625 advisory.

    Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This     software, such as Apache HTTP Server, is common to multiple JBoss middleware products and packaged under     Red Hat JBoss Core Services, to allow for faster distribution of updates and for a more consistent update     experience.

    This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.57 Service Pack 2 serves as a     replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.57 Service Pack 1, and includes bug     fixes and enhancements, which are documented in the Release Notes linked to in the References section.

    Security Fix(es):

    * curl: a heap based buffer overflow in the SOCKS5 proxy handshake (CVE-2023-38545)
    * curl: out of heap memory issue due to missing limit on header quantity (CVE-2023-38039)
    * curl: cookie injection with none file (CVE-2023-38546)
    * jbcs-httpd24-mod_jk: httpd: Apache Tomcat Connectors (mod_jk) Information Disclosure (CVE-2023-41081)
    * jbcs-httpd24-openssl: OpenSSL: Excessive time spent checking DH q parameter value (CVE-2023-3817)
    * mod_http2: reset requests exhaust memory (incomplete fix of CVE-2023-44487) (CVE-2023-45802)
    * openssl: Excessive time spent checking DH keys and parameters (CVE-2023-3446)
    * openssl: Invalid certificate policies in leaf certificates are silently ignored (CVE-2023-0465)
    * openssl: Possible DoS translating ASN.1 object identifiers (CVE-2023-2650)
    * openssl: Denial of service by excessive resource usage in verifying X509 policy constraints     (CVE-2023-0464)
    * openssl: Certificate policy check not enabled (CVE-2023-0466)

    A Red Hat Security Bulletin which addresses further details about this flaw is available in the References     section.

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3580 advisory.

  - The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration     included JkOptions +ForwardDirectories but the configuration did not provide explicit mounts for all     possible proxied requests, mod_jk would use an implicit mapping and map the request to the first defined     worker. Such an implicit mapping could result in the unintended exposure of the status worker and/or     bypass security constraints configured in httpd. As of JK 1.2.49, the implicit mapping functionality has     been removed and all mappings must now be via explicit configuration. Only mod_jk is affected by this     issue. The ISAPI redirector is not affected. This issue affects Apache Tomcat Connectors (mod_jk only):
    from 1.2.0 through 1.2.48. Users are recommended to upgrade to version 1.2.49, which fixes the issue.
    (CVE-2023-41081)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
200358	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 : mod_jk vulnerability (USN-6826-1)	Nessus	Ubuntu Local Security Checks	high
195032	Oracle Linux 9 : mod_jk / and / mod_proxy_cluster (ELSA-2024-2387)	Nessus	Oracle Linux Local Security Checks	high
194753	RHEL 9 : mod_jk and mod_proxy_cluster (RHSA-2024:2387)	Nessus	Red Hat Local Security Checks	high
193179	SUSE SLES12 Security Update : apache2-mod_jk (SUSE-SU-2024:1198-1)	Nessus	SuSE Local Security Checks	high
186674	RHEL 7 / 8 : Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP2 (RHSA-2023:7625)	Nessus	Red Hat Local Security Checks	critical
181836	Debian DLA-3580-1 : libapache-mod-jk - LTS security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2023-41081

high

Tenable Plugins

high

high

high

high

critical

high