UpHeron
All vulnerabilities

Servers and applications

CVE-2022-45143

The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.

Severity
High 7.5
Published
3 Jan 2023
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
9.0.69
Sources
NVD

Affected software

SoftwareAffected versions
Apache TomcatServers and applications · cpe:a:apache:tomcat
  • Version 10.1.1
  • Version 10.1.0-milestone17
  • Version 10.1.0-milestone16
  • Version 10.1.0-milestone15
All 20 release lines
  • Version 8.5.83
  • From 9.0.40 before 9.0.69
  • Version 10.1.0-milestone1
  • Version 10.1.0-milestone2
  • Version 10.1.0-milestone3
  • Version 10.1.0-milestone4
  • Version 10.1.0-milestone5
  • Version 10.1.0-milestone6
  • Version 10.1.0-milestone7
  • Version 10.1.0-milestone8
  • Version 10.1.0-milestone9
  • Version 10.1.0-milestone10
  • Version 10.1.0-milestone11
  • Version 10.1.0-milestone12
  • Version 10.1.0-milestone13
  • Version 10.1.0-milestone14
  • Version 10.1.0-milestone15
  • Version 10.1.0-milestone16
  • Version 10.1.0-milestone17
  • Version 10.1.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-45143
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-45143