Search for vulnerabilities
Vulnerability details: VCID-y9c8-mem2-aaam
Vulnerability ID VCID-y9c8-mem2-aaam
Aliases CVE-2022-45143
GHSA-rq2w-37h9-vg94
Summary The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-116 Improper Encoding or Escaping of Output
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 7.5 https://access.redhat.com/errata/RHSA-2023:3954
ssvc Track https://access.redhat.com/errata/RHSA-2023:3954
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-45143.json
epss 0.00275 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00275 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00275 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00275 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00337 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00337 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00337 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00337 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00337 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00337 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00337 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00337 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00337 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00337 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00337 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00337 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00769 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00769 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00769 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00769 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00769 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00769 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00769 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00769 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00769 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00769 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00933 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.00933 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
epss 0.01525 https://api.first.org/data/v1/epss?cve=CVE-2022-45143
apache_tomcat Low https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45143
cvssv3.1 7.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-rq2w-37h9-vg94
cvssv3.1_qr LOW https://github.com/advisories/GHSA-rq2w-37h9-vg94
cvssv3.1 7.5 https://github.com/apache/tomcat
generic_textual HIGH https://github.com/apache/tomcat
cvssv3.1 7.5 https://github.com/apache/tomcat/commit/0cab3a56bd89f70e7481bb0d68395dc7e130dbbf
generic_textual HIGH https://github.com/apache/tomcat/commit/0cab3a56bd89f70e7481bb0d68395dc7e130dbbf
cvssv3.1 7.5 https://github.com/apache/tomcat/commit/6a0ac6a438cbbb66b6e9c5223842f53bf0cb50aa
generic_textual HIGH https://github.com/apache/tomcat/commit/6a0ac6a438cbbb66b6e9c5223842f53bf0cb50aa
cvssv3.1 7.5 https://github.com/apache/tomcat/commit/b336f4e58893ea35114f1e4a415657f723b1298e
generic_textual HIGH https://github.com/apache/tomcat/commit/b336f4e58893ea35114f1e4a415657f723b1298e
cvssv3.1 7.5 https://lists.apache.org/thread/yqkd183xrw3wqvnpcg3osbcryq85fkzj
generic_textual HIGH https://lists.apache.org/thread/yqkd183xrw3wqvnpcg3osbcryq85fkzj
cvssv3 7.5 https://nvd.nist.gov/vuln/detail/CVE-2022-45143
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2022-45143
cvssv3.1 7.5 https://security.gentoo.org/glsa/202305-37
generic_textual HIGH https://security.gentoo.org/glsa/202305-37
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-45143.json
https://api.first.org/data/v1/epss?cve=CVE-2022-45143
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/apache/tomcat
https://github.com/apache/tomcat/commit/0cab3a56bd89f70e7481bb0d68395dc7e130dbbf
https://github.com/apache/tomcat/commit/6a0ac6a438cbbb66b6e9c5223842f53bf0cb50aa
https://github.com/apache/tomcat/commit/b336f4e58893ea35114f1e4a415657f723b1298e
https://lists.apache.org/thread/yqkd183xrw3wqvnpcg3osbcryq85fkzj
https://security.gentoo.org/glsa/202305-37
https://security.netapp.com/advisory/ntap-20230216-0009/
2158695 https://bugzilla.redhat.com/show_bug.cgi?id=2158695
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:tomcat:10.1.0:milestone1:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone10:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:tomcat:10.1.0:milestone10:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone11:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:tomcat:10.1.0:milestone11:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone12:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:tomcat:10.1.0:milestone12:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone13:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:tomcat:10.1.0:milestone13:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone14:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:tomcat:10.1.0:milestone14:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone15:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:tomcat:10.1.0:milestone15:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone16:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:tomcat:10.1.0:milestone16:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone17:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:tomcat:10.1.0:milestone17:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone2:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:tomcat:10.1.0:milestone2:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone3:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:tomcat:10.1.0:milestone3:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone4:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:tomcat:10.1.0:milestone4:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone5:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:tomcat:10.1.0:milestone5:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone6:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:tomcat:10.1.0:milestone6:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone7:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:tomcat:10.1.0:milestone7:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone8:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:tomcat:10.1.0:milestone8:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone9:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:tomcat:10.1.0:milestone9:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:tomcat:10.1.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:8.5.83:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:tomcat:8.5.83:*:*:*:*:*:*:*
CVE-2022-45143 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45143
CVE-2022-45143 https://nvd.nist.gov/vuln/detail/CVE-2022-45143
GHSA-rq2w-37h9-vg94 https://github.com/advisories/GHSA-rq2w-37h9-vg94
RHSA-2023:1663 https://access.redhat.com/errata/RHSA-2023:1663
RHSA-2023:1664 https://access.redhat.com/errata/RHSA-2023:1664
RHSA-2023:3954 https://access.redhat.com/errata/RHSA-2023:3954
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/errata/RHSA-2023:3954
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-08T18:37:50Z/ Found at https://access.redhat.com/errata/RHSA-2023:3954
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-45143.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/apache/tomcat
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/apache/tomcat/commit/0cab3a56bd89f70e7481bb0d68395dc7e130dbbf
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/apache/tomcat/commit/6a0ac6a438cbbb66b6e9c5223842f53bf0cb50aa
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/apache/tomcat/commit/b336f4e58893ea35114f1e4a415657f723b1298e
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://lists.apache.org/thread/yqkd183xrw3wqvnpcg3osbcryq85fkzj
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2022-45143
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2022-45143
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://security.gentoo.org/glsa/202305-37
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.67700
EPSS Score 0.00275
Published At Dec. 17, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.