Staging Environment: Content and features may be unstable or change without notice.
Advisory details: vulnrichment / CVE-2022-45143
Advisory ID vulnrichment/CVE-2022-45143
Aliases
Summary The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-116 Improper Encoding or Escaping of Output
System Score Found at
ssvc Track
Reference id Reference type URL
https://lists.apache.org/thread/yqkd183xrw3wqvnpcg3osbcryq85fkzj
https://security.gentoo.org/glsa/202305-37
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-01T14:55:21Z/ Found at None

Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-01T14:55:21Z/

Decision: Track

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2022/45xxx/CVE-2022-45143.json

Source Advisory: vulnrichment/CVE-2022-45143

View SSVC decision tree 
[{'Exploitation': 'none'},
 {'Automatable': 'no'},
 {'Technical Impact': 'partial'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]