tomcat: JsonErrorReportValve injection

🗓️ 12 Apr 2023 12:49:15Reported by RedHatType

Tomcat vulnerability allows injection via the ErrorReportValve by not escaping type, message, or description in invalid JSON.

Reporter	Title	Published	Views	Family All 148
IBM Security Bulletins	Security Bulletin: Vulnerability in Apache Tomcat affects IBM Process Mining . Multiple CVEs	27 Jun 202311:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities	7 Mar 202303:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Rational Build Forge 8.0.0.24 addresses multiple vulnerabilities by updating Apache Tomcat Server	31 Oct 202315:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM UrbanCode Release is affected by CVE-2022-45143	20 Jan 202316:16	–	ibm
IBM Security Bulletins	Security Bulletin: IBM UrbanCode Build is affected by CVE-2022-45143	25 Jan 202311:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	7 Jun 202316:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM includes components with known vulnerabilities	26 Mar 202503:39	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insights 1.6.9 addresses multiple security vulnerabilities.	18 Jul 202313:09	–	ibm
IBM Security Bulletins	Security Bulletin: App Connect Professional is affected by JsonErrorReportValve in Apache Tomcat.	1 Feb 202305:59	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Apache Tomcat affects IBM Process Mining . CVE-2022-45143	5 May 202314:27	–	ibm

Vulners

Node

AND

Source	Link
access	www.access.redhat.com/security/cve/CVE-2022-45143
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
lists	www.lists.apache.org/thread/yqkd183xrw3wqvnpcg3osbcryq85fkzj
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-45143
cve	www.cve.org/CVERecord

28 Jun 2026 12:38Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.17.5

EPSS0.02505

SSVC