{"cve":"CVE-2022-34305","nvd":{"published":"2022-06-23T11:15:07.977","modified":"2026-10-08T22:17:21.903","status":"Modified","description":"In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1},"cwes":["CWE-79"],"references":["http://www.openwall.com/lists/oss-security/2022/06/23/1","https://lists.apache.org/thread/k04zk0nq6w57m72w5gb0r6z9ryhmvr4k","https://security.gentoo.org/glsa/202208-34","https://security.netapp.com/advisory/ntap-20220729-0006/","http://www.openwall.com/lists/oss-security/2022/06/23/1"],"products":["apache:tomcat"],"source":"nvd","synced_at":"2026-10-19T21:32:39.174919249+00:00"},"epss":{"cve":"CVE-2022-34305","score":0.06714,"percentile":0.93875,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-6j88-6whg-x687","url":"https://osv.dev/vulnerability/GHSA-6j88-6whg-x687","summary":"Cross-site Scripting in Apache Tomcat","modified":"2024-02-21T05:33:07.078569Z","packages":[{"ecosystem":"Maven","name":"org.apache.tomcat:tomcat","purl":"pkg:maven/org.apache.tomcat/tomcat","ranges":[">=10.1.0-M1 <10.1.0-M17"],"fixed":["10.1.0-M17"]},{"ecosystem":"Maven","name":"org.apache.tomcat:tomcat","purl":"pkg:maven/org.apache.tomcat/tomcat","ranges":[">=10.0.0-M1 <10.0.22"],"fixed":["10.0.22"]},{"ecosystem":"Maven","name":"org.apache.tomcat:tomcat","purl":"pkg:maven/org.apache.tomcat/tomcat","ranges":[">=9.0.30 <9.0.65"],"fixed":["9.0.65"]},{"ecosystem":"Maven","name":"org.apache.tomcat:tomcat","purl":"pkg:maven/org.apache.tomcat/tomcat","ranges":[">=8.5.50 <8.5.82"],"fixed":["8.5.82"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}