CVE-2022-45143

The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.

Score

CVSS 3.1 7.5 High

Status

Modified - security@apache.org

Published

2023-01-03

Last modified

2024-08-03

Weaknesses

CWE-116

Affected products

• Tomcat (Apache)
• Apache Tomcat (Apache Software Foundation)

References

• https://lists.apache.org/thread/yqkd183xrw3wqvnpcg3osbcryq85fkzj
• https://security.gentoo.org/glsa/202305-37
• https://security.netapp.com/advisory/ntap-20230216-0009/