GitHub Advisoryadvisory · Maven

GHSA-rq2w-37h9-vg94 Apache Tomcat improperly escapes input from JsonErrorReportValve

HIGH Published 2023-01-03 Modified 2024-04-23 Official page ↗
Aliases
CVE-2022-45143
Ecosystem
Maven
Packages
org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-catalina, org.apache.tomcat:tomcat-util
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-116, CWE-74
Reviewed
2023-01-05

Affected packages

• Maven org.apache.tomcat.embed:tomcat-embed-core: >= 8.5.83, < 8.5.84 → fixed in 8.5.84 • Maven org.apache.tomcat.embed:tomcat-embed-core: >= 9.0.40, < 9.0.69 → fixed in 9.0.69 • Maven org.apache.tomcat.embed:tomcat-embed-core: >= 10.1.0, < 10.1.2 → fixed in 10.1.2 • Maven org.apache.tomcat:tomcat-catalina: >= 10.1.0, < 10.1.2 → fixed in 10.1.2 • Maven org.apache.tomcat:tomcat-util: >= 8.5.83, < 8.5.84 → fixed in 8.5.84 • Maven org.apache.tomcat:tomcat-util: >= 9.0.40, < 9.0.69 → fixed in 9.0.69

Description

The `JsonErrorReportValve` in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 does not escape the `type`, `message` or `description` values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.

Related

Alias · CVE (1)

  • CVE-2022-45143 The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description… vulnerability

Weakness · CWE (2)

  • CWE-116 Improper Encoding or Escaping of Output weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References