CVE-2022-45143
High
Description
The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Apache Tomcat
PublishedJan 3, 2023
First seenJan 3, 2023
Weakness typeCWE-116CWE-116
How to fix
Update
- apache tomcat9.0.69 or later
- org.apache.tomcat.embed:tomcat-embed-core8.5.84, 9.0.69, 10.1.2 or later
- org.apache.tomcat:tomcat-catalina10.1.2 or later
- org.apache.tomcat:tomcat-util8.5.84, 9.0.69 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache tomcat | 9.0.40 ≤ v < 9.0.69, 8.5.83, 10.1.0, 10.1.1 | 9.0.69 |
| org.apache.tomcat.embed:tomcat-embed-coreMaven | 8.5.83 ≤ v < 8.5.84, 9.0.40 ≤ v < 9.0.69, 10.1.0 ≤ v < 10.1.2 | 8.5.84, 9.0.69, 10.1.2 |
| org.apache.tomcat:tomcat-catalinaMaven | 10.1.0 ≤ v < 10.1.2 | 10.1.2 |
| org.apache.tomcat:tomcat-utilMaven | 8.5.83 ≤ v < 8.5.84, 9.0.40 ≤ v < 9.0.69 | 8.5.84, 9.0.69 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.