CVE-2022-45143

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-45143
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-45143.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-45143
Aliases
Downstream
ALSA (1)
CLEANSTART (20)
CLSA (4)
DEBIAN (1)
MGASA (1)
openSUSE (2)
RHSA (4)
ROOT (1)
SUSE (1)
UBUNTU (1)
Related
ALSA (1)
openSUSE (2)
SUSE (1)
Published
2023-01-03T18:12:28Z
Modified
2026-10-29T11:12:04Z
Summary
Apache Tomcat: JsonErrorReportValve escaping
Details

The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.

Database specific 
{
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-116"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/45xxx/CVE-2022-45143.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "8.5.83"
                        },
                        {
                            "last_affected": "8.5.83"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandaloneSingleVersion"
                }
            ]
        },
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "10.1.0-M1"
                        },
                        {
                            "last_affected": "10.1.1"
                        },
                        {
                            "introduced": "9.0.40"
                        },
                        {
                            "last_affected": "9.0.68"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/apache/tomcat

Affected ranges

Type
GIT
Repo
https://github.com/apache/tomcat
Events
Introduced
11cce490eb67a8aca64377a22c0cea2e38896725
Fixed
cd5fd93c5df3699868ec39731f5a347450112299
Introduced
702df4f4db92b59e01d5d8824190ce2652d74a76
Last Affected
934df02dc68e72b95a38f372017f1b89b0d13a76
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "9.0.40"
                },
                {
                    "fixed": "9.0.69"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:8.5.83:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "8.5.83"
                },
                {
                    "last_affected": "8.5.83"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone1:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.1.0-milestone1"
                },
                {
                    "last_affected": "10.1.0-milestone1"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone10:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.1.0-milestone10"
                },
                {
                    "last_affected": "10.1.0-milestone10"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone11:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.1.0-milestone11"
                },
                {
                    "last_affected": "10.1.0-milestone11"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone12:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.1.0-milestone12"
                },
                {
                    "last_affected": "10.1.0-milestone12"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone13:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.1.0-milestone13"
                },
                {
                    "last_affected": "10.1.0-milestone13"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone14:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.1.0-milestone14"
                },
                {
                    "last_affected": "10.1.0-milestone14"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone15:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.1.0-milestone15"
                },
                {
                    "last_affected": "10.1.0-milestone15"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone16:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.1.0-milestone16"
                },
                {
                    "last_affected": "10.1.0-milestone16"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone17:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.1.0-milestone17"
                },
                {
                    "last_affected": "10.1.0-milestone17"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone2:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.1.0-milestone2"
                },
                {
                    "last_affected": "10.1.0-milestone2"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone3:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.1.0-milestone3"
                },
                {
                    "last_affected": "10.1.0-milestone3"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone4:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.1.0-milestone4"
                },
                {
                    "last_affected": "10.1.0-milestone4"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone5:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.1.0-milestone5"
                },
                {
                    "last_affected": "10.1.0-milestone5"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone6:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.1.0-milestone6"
                },
                {
                    "last_affected": "10.1.0-milestone6"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone7:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.1.0-milestone7"
                },
                {
                    "last_affected": "10.1.0-milestone7"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone8:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.1.0-milestone8"
                },
                {
                    "last_affected": "10.1.0-milestone8"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone9:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.1.0-milestone9"
                },
                {
                    "last_affected": "10.1.0-milestone9"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:10.1.1:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.1.1"
                },
                {
                    "last_affected": "10.1.1"
                }
            ],
            "source": "CPE_STRING"
        }
    ]
}

Affected versions

10.*
10.1.0-milestone1
10.1.0-milestone10
10.1.0-milestone11
10.1.0-milestone12
10.1.0-milestone13
10.1.0-milestone14
10.1.0-milestone15
10.1.0-milestone16
10.1.0-milestone17
10.1.0-milestone2
10.1.0-milestone3
10.1.0-milestone4
10.1.0-milestone5
10.1.0-milestone6
10.1.0-milestone7
10.1.0-milestone8
10.1.0-milestone9
10.1.1
8.*
8.5.83

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-45143.json"