CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NCVE-2022-45143
High (7.5) in apache tomcat. EPSS 2.6% chance of exploitation in the next 30 days. Fixed in org.apache.tomcat.embed:tomcat-embed-core 10.1.2, 8.5.84, 9.0.69.
The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.
Severity
- EPSS
- 2.6% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
- CWE
- CWE-116
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:tomcat
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-rq2w-37h9-vg94 | Maven | org.apache.tomcat.embed:tomcat-embed-core | >=8.5.83 <8.5.84 | 8.5.84 |
| GHSA-rq2w-37h9-vg94 | Maven | org.apache.tomcat.embed:tomcat-embed-core | >=9.0.40 <9.0.69 | 9.0.69 |
| GHSA-rq2w-37h9-vg94 | Maven | org.apache.tomcat.embed:tomcat-embed-core | >=10.1.0 <10.1.2 | 10.1.2 |
| GHSA-rq2w-37h9-vg94 | Maven | org.apache.tomcat:tomcat-catalina | >=10.1.0 <10.1.2 | 10.1.2 |
| GHSA-rq2w-37h9-vg94 | Maven | org.apache.tomcat:tomcat-util | >=8.5.83 <8.5.84 | 8.5.84 |
| GHSA-rq2w-37h9-vg94 | Maven | org.apache.tomcat:tomcat-util | >=9.0.40 <9.0.69 | 9.0.69 |