CVE-2022-34305

🗓️ 23 Jun 2022 10:30:16Reported by apacheType

cve🔗 web.nvd.nist.gov📰️ 10 Media mentions👁 447 Views

Apache Tomcat versions 8.5.50 to 8.5.81, 9.0.30 to 9.0.64, 10.0.0-M1 to 10.0.22, and 10.1.0-M1 to 10.1.0-M16 are vulnerable to XSS via Form authentication example

Reporter	Title	Published	Views	Family All 126
IBM Security Bulletins	Security Bulletin: IBM Rational Build Forge 8.0.0.24 addresses multiple vulnerabilities by updating Apache Tomcat Server	31 Oct 202315:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	8 Jun 202321:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to cross-site scripting due to Apache Tomcat (CVE-2022-34305)	10 Jan 202310:31	–	ibm
IBM Security Bulletins	Security Bulletin: The CVE-2022-34305 vulnerability in Apache Tomcat affects App Connect Professional.	15 Jul 202205:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by vulnerability in Apache Tomcat	7 Nov 202407:43	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insights 1.6.9 addresses multiple security vulnerabilities.	18 Jul 202313:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM UrbanCode Build is affected by CVE-2022-34305	20 Dec 202207:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities including remote code execution in Apache Log4j 1.x	3 Aug 202216:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM UrbanCode Release is affected by CVE-2022-34305	20 Jan 202316:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to cross-site scripting in Apache Tomcat (CVE-2022-34305)	12 Jan 202321:59	–	ibm

NVD

Vulners

Node

apache tomcatRange8.5.50–8.5.81

apache tomcatRange9.0.30–9.0.64

apache tomcatRange10.0.0–10.0.22

apache tomcatMatch10.1.0milestone1

apache tomcatMatch10.1.0milestone10

apache tomcatMatch10.1.0milestone11

apache tomcatMatch10.1.0milestone12

apache tomcatMatch10.1.0milestone13

apache tomcatMatch10.1.0milestone14

apache tomcatMatch10.1.0milestone15

apache tomcatMatch10.1.0milestone16

apache tomcatMatch10.1.0milestone2

apache tomcatMatch10.1.0milestone3

apache tomcatMatch10.1.0milestone4

apache tomcatMatch10.1.0milestone5

apache tomcatMatch10.1.0milestone6

apache tomcatMatch10.1.0milestone7

apache tomcatMatch10.1.0milestone8

apache tomcatMatch10.1.0milestone9

[
  {
    "product": "Apache Tomcat",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "status": "affected",
        "version": "Apache Tomcat 8.5 8.5.50 to 8.5.81"
      },
      {
        "status": "affected",
        "version": "Apache Tomcat 9 9.0.30 to 9.0.64"
      },
      {
        "status": "affected",
        "version": "Apache Tomcat 10.0 10.0.0-M1 to 10.0.22"
      },
      {
        "status": "affected",
        "version": "Apache Tomcat 10.1 10.1.0-M1 to 10.1.0-M16"
      }
    ]
  }
]

Source	Link
openwall	www.openwall.com/lists/oss-security/2022/06/23/1
security	www.security.netapp.com/advisory/ntap-20220729-0006/
lists	www.lists.apache.org/thread/k04zk0nq6w57m72w5gb0r6z9ryhmvr4k
security	www.security.gentoo.org/glsa/202208-34

21 Nov 2024 07:09Current

6.3Medium risk

Vulners AI Score6.3

CVSS 24.3

CVSS 3.16.1

EPSS0.17371

CWE-79