GitHub Advisoryadvisory · Maven

GHSA-6j88-6whg-x687 Cross-site Scripting in Apache Tomcat

MEDIUM Published 2022-06-24 Modified 2022-07-05 Official page ↗
Aliases
CVE-2022-34305
Ecosystem
Maven
Packages
org.apache.tomcat:tomcat
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-06-25

Affected packages

• Maven org.apache.tomcat:tomcat: >= 10.1.0-M1, < 10.1.0-M17 → fixed in 10.1.0-M17 • Maven org.apache.tomcat:tomcat: >= 10.0.0-M1, < 10.0.22 → fixed in 10.0.22 • Maven org.apache.tomcat:tomcat: >= 9.0.30, < 9.0.65 → fixed in 9.0.65 • Maven org.apache.tomcat:tomcat: >= 8.5.50, < 8.5.82 → fixed in 8.5.82

Description

In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.

Related

Alias · CVE (1)

  • CVE-2022-34305 In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References