Apache Tomcat 10.0.0-M1 < 10.0.27 Request Smuggling

The version of Apache Tomcat installed on the remote host is 8.5.x to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0. It is, therefore, affected by a request smuggling vulnerability. If Tomcat was configured to ignore invalid HTTP headers via setting rejectIllegalHeader t...

Apache Tomcat 10.1.0-M1 < 10.1.1 Request Smuggling

The version of Apache Tomcat installed on the remote host is 8.5.x to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0. It is, therefore, affected by a request smuggling vulnerability. If Tomcat was configured to ignore invalid HTTP headers via setting rejectIllegalHeader t...

Apache Tomcat 9.0.0-M1 < 9.0.69 JsonErrorReportValve Injection

The version of Apache Tomcat installed on the remote host is 8.5.x to 8.5.83, 9.0.0-M1 to 9.0.68 or 10.1.0-M1 to 10.1.1. It is, therefore, affected by a JsonErrorReportValve injection vulnerability. The JsonErrorReportValve did not escape the type, message or description values. In some...

Apache Tomcat 8.5.x < 8.5.83 Request Smuggling

The version of Apache Tomcat installed on the remote host is 8.5.x to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0. It is, therefore, affected by a request smuggling vulnerability. If Tomcat was configured to ignore invalid HTTP headers via setting rejectIllegalHeader t...

Apache Tomcat 9.0.0-M1 < 9.0.68 Request Smuggling

The version of Apache Tomcat installed on the remote host is 8.5.x to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0. It is, therefore, affected by a request smuggling vulnerability. If Tomcat was configured to ignore invalid HTTP headers via setting rejectIllegalHeader t...

Apache Tomcat JsonErrorReportValve Injection Vulnerability (Jan 2023) - Windows

Apache Tomcat is prone to a JsonErrorReportValve injection vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Apache Tomcat JsonErrorReportValve Injection Vulnerability (Jan 2023) - Linux

Apache Tomcat is prone to a JsonErrorReportValve injection vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Apache Tomcat improperly escapes input from JsonErrorReportValve

The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 does not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or...

GHSA-RQ2W-37H9-VG94 Apache Tomcat improperly escapes input from JsonErrorReportValve

The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 does not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or...

CVE-2022-45143

The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or...

DEBIAN-CVE-2022-45143

The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or...

Design/Logic Flaw

The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or...

CVE-2022-45143

The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or...

UBUNTU-CVE-2022-45143

The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or...

CVE-2022-45143 Apache Tomcat: JsonErrorReportValve escaping

The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or...

CVE-2022-45143 Apache Tomcat: JsonErrorReportValve escaping

The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or...

CVE-2022-45143 Apache Tomcat: JsonErrorReportValve escaping

The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or...

CVE-2022-45143

CVE-2022-45143 affects Apache Tomcat: the JsonErrorReportValve failed to escape type, message, or description fields, which could be constructed from user data and allow manipulation of JSON output. Affected versions include Tomcat 8.5.83, 9.0.40–9.0.68, and 10.1.0-M1–10.1.1. The issue’s impact i...

CVE-2022-45143

The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or...

Security Bulletin: IBM Security SOAR is using a component with known vulnerabilities (CVE-2022-42252)

Summary IBM Security SOAR uses an older version of Apache Tomcat 9.0.63 that may be identified and exploited. An update has been released which addresses these issues. The version of Apache Tomcat included in the latest version of IBM ® Security Soar is 9.0.68. Vulnerability Details...