Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2022-45143

Good to know:

icon
icon

Date: January 3, 2023

The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.

Language: Java

Severity Score

Related Resources (9)

https://nvd.nist.gov/vuln/detail/CVE-2022-45143
https://github.com/apache/tomcat/commit/0cab3a56bd89f70e7481bb0d68395dc7e130dbbf
https://github.com/apache/tomcat/commit/b336f4e58893ea35114f1e4a415657f723b1298e
https://lists.apache.org/thread/yqkd183xrw3wqvnpcg3osbcryq85fkzj
https://github.com/apache/tomcat
https://security.gentoo.org/glsa/202305-37
https://github.com/apache/tomcat/commit/6a0ac6a438cbbb66b6e9c5223842f53bf0cb50aa
https://access.redhat.com/security/cve/CVE-2022-45143
https://www.mend.io/vulnerability-database/CVE-2022-45143

Severity Score

Weakness Type (CWE)

Improper Encoding or Escaping of Output

CWE-116

Injection

CWE-74

Top Fix

icon

Upgrade Version

Upgrade to version org.apache.tomcat:tomcat-catalina:8.5.84,9.0.69,10.1.2, org.apache.tomcat.embed:tomcat-embed-core:8.5.84,9.0.69,10.1.2, org.apache.tomcat.experimental:tomcat-embed-programmatic:9.0.69,10.1.2

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): HIGH
Availability (A): NONE

Do you need more information?

Contact Us