CVE-2022-45143

CVE	CVE-2022-45143
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2023-01-03 19:15:00 UTC
Updated	2023-06-27 13:15:00 UTC
Description	The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.

Problem Types: CWE-116

Type	Vendor	Product	Version	Update	Edition	Language
Application	Apache	Tomcat	All	All	All	All
Application	Apache	Tomcat	10.1.0	milestone1	All	All
Application	Apache	Tomcat	10.1.0	milestone10	All	All
Application	Apache	Tomcat	10.1.0	milestone11	All	All
Application	Apache	Tomcat	10.1.0	milestone12	All	All
Application	Apache	Tomcat	10.1.0	milestone13	All	All
Application	Apache	Tomcat	10.1.0	milestone14	All	All
Application	Apache	Tomcat	10.1.0	milestone15	All	All
Application	Apache	Tomcat	10.1.0	milestone16	All	All
Application	Apache	Tomcat	10.1.0	milestone17	All	All
Application	Apache	Tomcat	10.1.0	milestone2	All	All
Application	Apache	Tomcat	10.1.0	milestone3	All	All
Application	Apache	Tomcat	10.1.0	milestone4	All	All
Application	Apache	Tomcat	10.1.0	milestone5	All	All
Application	Apache	Tomcat	10.1.0	milestone6	All	All
Application	Apache	Tomcat	10.1.0	milestone7	All	All
Application	Apache	Tomcat	10.1.0	milestone8	All	All
Application	Apache	Tomcat	10.1.0	milestone9	All	All
Application	Apache	Tomcat	10.1.1	All	All	All
Application	Apache	Tomcat	8.5.83	All	All	All

Reference	Source	Link	Tags
lists.apache.org/thread/yqkd183xrw3wqvnpcg3osbcryq85fkzj	MISC	lists.apache.org
Apache Tomcat: Multiple Vulnerabilities (GLSA 202305-37) — Gentoo security	MISC	security.gentoo.org
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

150628 Apache Tomcat JsonErrorReportValve Injection Vulnerability (CVE-2022-45143)
181700 Debian Security Update for tomcat9 (DSA 5381-1)
182371 Debian Security Update for tomcat9 (CVE-2022-45143)
20341 Oracle Database 19c Critical Patch Update - April 2023
20342 Oracle Database 21c Critical Patch Update - April 2023
20343 Oracle Database 19c Critical OJVM Patch Update - April 2023
20354 Oracle Database 19c Critical Patch Update - July 2023
20355 Oracle Database 21c Critical Patch Update - July 2023
20356 Oracle Database 19c Critical OJVM Patch Update - July 2023
355155 Amazon Linux Security Advisory for tomcat9 : ALAS2023-2023-176
356243 Amazon Linux Security Advisory for tomcat : ALASTOMCAT8.5-2023-013
356298 Amazon Linux Security Advisory for tomcat : ALASTOMCAT9-2023-008
710733 Gentoo Linux Apache Tomcat Multiple Vulnerabilities (GLSA 202305-37)
730681 Apache Tomcat JsonErrorReportValve injection Vulnerability (CVE-2022-45143)
730682 Apache Tomcat JsonErrorReportValve injection Vulnerability (CVE-2022-45143)
730683 Apache Tomcat JsonErrorReportValve injection Vulnerability (CVE-2022-45143)
730980 Atlassian Confluence Data Center and Server Unauthenticated expose to assets (CONFSERVER-93173)
753910 SUSE Enterprise Linux Security Update for tomcat (SUSE-SU-2023:1853-1)