My security scan is showing that mcs_ws.war and the expanded files show the log4j to be an old version.
CU5 and later
As of 23.4CU5, mcs_ws.war no longer is used and may be deleted. The new version is mcs_ui_app.war.
This was documented on the last line of this official techdoc.
Here is the entry:
Additionally, the deprecated web application mcs_ws will be disabled permanently and is no longer supported.