PT-2022-7336 · Apache+5 · Apache Tomcat+5
Published
2022-11-09
·
Updated
2026-05-18
·
CVE-2022-45143
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
Apache Tomcat versions 8.5.83, 9.0.40 through 9.0.68, 10.1.0-M1 through 10.1.1
Description
The issue is related to the JsonErrorReportValve in Apache Tomcat, which does not properly escape the
type, message, or description values. These values can be constructed from user-provided data, allowing users to supply values that could invalidate or manipulate the JSON output.Recommendations
For Apache Tomcat versions 8.5.83, 9.0.40 through 9.0.68, and 10.1.0-M1 through 10.1.1, consider upgrading to a version where this issue is fixed, as the exact fixed version is not specified in the provided information.
As a temporary workaround, consider restricting user input to prevent manipulation of the JSON output.
Restrict access to the JsonErrorReportValve to minimize the risk of exploitation.
Fix
DoS
Special Elements Injection
Improper Encoding or Escaping of Output
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Apache Tomcat
Astra Linux
Confluence
Red Os
Suse