CVE-2022-45143
CVE-2022-45143 · Apache Tomcat: JsonErrorReportValve escaping
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.
CVSS 7.5 · High · EPSS 2.6% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
apache tomcat
- Versions
- ≥ 10.1.0-M1, ≤ 10.1.1: Affected (semver)
- ≥ 9.0.40, ≤ 9.0.68: Affected (semver)
- 8.5.83: Affected
No fix published
tomcat9 Debian:12
- Affected ranges
- ECOSYSTEM: < 9.0.70-1
Update to 9.0.70-1
tomcat9 Debian:13
- Affected ranges
- ECOSYSTEM: < 9.0.70-1
Update to 9.0.70-1
tomcat9 Debian:14
- Affected ranges
- ECOSYSTEM: < 9.0.70-1
Update to 9.0.70-1
tomcat9 Ubuntu:Pro:22.04:LTS
- Versions
- 9.0.43-3
- 9.0.54-1
- 9.0.55-1
- 9.0.58-1
- 9.0.58-1ubuntu0.1
- 9.0.58-1ubuntu0.1+esm1
- 9.0.58-1ubuntu0.1+esm2
- 9.0.58-1ubuntu0.1+esm3
- 9.0.58-1ubuntu0.1+esm4
- 9.0.58-1ubuntu0.2
- 9.0.58-1ubuntu0.2+esm1
- 9.0.58-1ubuntu0.2+esm2
- 9.0.58-1ubuntu0.2+esm3
- 9.0.58-1ubuntu0.2+esm4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published