CVE-2022-45143
Last modified
CVE-2022-45143 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.. EPSS estimates a 2.50% chance of exploitation in the next 30 days.
Description
The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Apache | Tomcat | >= 9.0.40, < 9.0.69 | — |
| Apache | Tomcat | 8.5.83 | — |
| Apache | Tomcat | 10.1.0 | Milestone1 |
| Apache | Tomcat | 10.1.1 | — |
References
- https://lists.apache.org/thread/yqkd183xrw3wqvnpcg3osbcryq85fkzjMailing List, Vendor Advisory
- https://security.gentoo.org/glsa/202305-37Third Party Advisory
- https://lists.apache.org/thread/yqkd183xrw3wqvnpcg3osbcryq85fkzjMailing List, Vendor Advisory
- https://security.gentoo.org/glsa/202305-37Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-45143?
How severe is CVE-2022-45143?
How do I fix CVE-2022-45143?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-45138The configuration backend of the web-based management can be…9.8
- CVE-2022-45139A CORS Misconfiguration in the web-based management allows a…5.3
- CVE-2022-4514A vulnerability, which was classified as problematic, was fo…6.1
- CVE-2022-45140The configuration backend allows an unauthenticated user to …9.8
- CVE-2022-45141Since the Windows Kerberos RC4-HMAC Elevation of Privilege V…9.8
- CVE-2022-45142The fix for CVE-2022-3437 included changing memcmp to be con…7.5
- CVE-2022-45144Algoo Tracim before 4.4.2 allows XSS via HTML file upload.6.1
- CVE-2022-45145egg-compile.scm in CHICKEN 5.x before 5.3.1 allows arbitrary…9.8
- CVE-2022-45146An issue was discovered in the FIPS Java API of Bouncy Castl…5.5
- CVE-2022-45147A vulnerability has been identified in SIMATIC PCS neo V4.0 …8.5
- CVE-2022-45148Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2022-45149A vulnerability was found in Moodle which exists due to insu…5.4
Are you affected by CVE-2022-45143?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST