CVE-2022-45143

Katalog CVE

CVSS 7.5 · High EPSS 2,5%

Kerentanan Improper Encoding or Escaping of Output pada apache tomcat. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.

Rincian

Terbit di NVD

3 Januari 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-116: Improper Encoding or Escaping of Output

EPSS (30 hari)

2,5% peluang dieksploitasi; lebih tinggi dari 84,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/yqkd183xrw3wqvnpcg3osbcryq85fkzj mailing list · advisory vendor
• https://security.gentoo.org/glsa/202305-37 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20230216-0009/