Ubuntu.comUB:CVE-2022-45143CVE-2022-45143
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
0.005 Low
EPSS
Percentile
75.9%
The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and
10.1.0-M1 to 10.1.1 did not escape the type, message or description values.
In some circumstances these are constructed from user provided data and it
was therefore possible for users to supply values that invalidated or
manipulated the JSON output.
References
github.com/apache/tomcat/commit/0cab3a56bd89f70e7481bb0d68395dc7e130dbbf (8.5.84)
github.com/apache/tomcat/commit/b336f4e58893ea35114f1e4a415657f723b1298e (9.0.69)
launchpad.net/bugs/cve/CVE-2022-45143
lists.apache.org/thread/yqkd183xrw3wqvnpcg3osbcryq85fkzj
nvd.nist.gov/vuln/detail/CVE-2022-45143
security-tracker.debian.org/tracker/CVE-2022-45143
www.cve.org/CVERecord?id=CVE-2022-45143
www.openwall.com/lists/oss-security/2023/01/03/1
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
0.005 Low
EPSS
Percentile
75.9%