CVE-2022-45143

Опубликовано: 03 янв. 2023

Источник: nvd

CVSS3: 7.5

EPSS Низкий

Описание

The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.

Ссылки

https://lists.apache.org/thread/yqkd183xrw3wqvnpcg3osbcryq85fkzj
Mailing List
Vendor Advisory
https://security.gentoo.org/glsa/202305-37
Third Party Advisory
https://lists.apache.org/thread/yqkd183xrw3wqvnpcg3osbcryq85fkzj
Mailing List
Vendor Advisory
https://security.gentoo.org/glsa/202305-37
Third Party Advisory
https://security.netapp.com/advisory/ntap-20230216-0009/

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

Версия от 9.0.40 (включая) до 9.0.69 (исключая)

cpe:2.3:a:apache:tomcat:8.5.83:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:10.1.0:milestone1:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:10.1.0:milestone10:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:10.1.0:milestone11:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:10.1.0:milestone12:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:10.1.0:milestone13:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:10.1.0:milestone14:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:10.1.0:milestone15:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:10.1.0:milestone16:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:10.1.0:milestone17:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:10.1.0:milestone2:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:10.1.0:milestone3:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:10.1.0:milestone4:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:10.1.0:milestone5:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:10.1.0:milestone6:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:10.1.0:milestone7:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:10.1.0:milestone8:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:10.1.0:milestone9:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:10.1.1:*:*:*:*:*:*:*

EPSS

Процентиль: 75%

0.00933

Низкий

7.5 High

CVSS3

Дефекты

CWE-116

Связанные уязвимости

CVE-2022-45143

CVSS3: 7.5

ubuntu

больше 2 лет назад

CVE-2022-45143

CVSS3: 7.5

redhat

больше 2 лет назад

CVE-2022-45143

CVSS3: 7.5

debian

больше 2 лет назад

The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and ...

SUSE-SU-2023:1853-1

suse-cvrf

около 2 лет назад

Security update for tomcat

GHSA-rq2w-37h9-vg94

CVSS3: 7.5

github

больше 2 лет назад

Apache Tomcat improperly escapes input from JsonErrorReportValve

EPSS

Процентиль: 75%

0.00933

Низкий

7.5 High

CVSS3

Дефекты

CWE-116