CVE-2022-34305

MediumCVSS 6.1/10Last modified Oct 8, 2026

Description

In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Tomcat	Apache Tomcat 8.5 8.5.50 to 8.5.81; Apache Tomcat 9 9.0.30 to 9.0.64; Apache Tomcat 10.0 10.0.0-M1 to 10.0.22; Apache Tomcat 10.1 10.1.0-M1 to 10.1.0-M16

References

http://www.openwall.com/lists/oss-security/2022/06/23/1Mailing List, Third Party Advisory
https://lists.apache.org/thread/k04zk0nq6w57m72w5gb0r6z9ryhmvr4kMailing List, Release Notes, Third Party Advisory
https://security.gentoo.org/glsa/202208-34Third Party Advisory
https://security.netapp.com/advisory/ntap-20220729-0006/Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/06/23/1Mailing List, Third Party Advisory
https://lists.apache.org/thread/k04zk0nq6w57m72w5gb0r6z9ryhmvr4kMailing List, Release Notes, Third Party Advisory
https://security.gentoo.org/glsa/202208-34Third Party Advisory
https://security.netapp.com/advisory/ntap-20220729-0006/Third Party Advisory

Timeline

Published: Jun 23, 2022
Last modified: Oct 8, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-343065.4IBM CICS TX Standard and Advanced 11.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. T CVE-2022-343074.3IBM CICS TX 11.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie value CVE-2022-343085.5IBM CICS TX 11.1 could allow a local user to cause a denial of service due to improper load handling. IBM X-Force ID: 229437.CVE-2022-343097.5IBM CICS TX Standard and Advanced 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sen CVE-2022-34317.8A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not dea CVE-2022-343107.5IBM CICS TX Standard and Advanced 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sen CVE-2022-343114.3IBM CICS TX Standard and Advanced 11.1 could allow a user with physical access to the web browser to gain access to the user's session due t CVE-2022-343123.3IBM CICS TX 11.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 229447.CVE-2022-343133.1IBM CICS TX 11.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie value CVE-2022-343143.3IBM CICS TX 11.1 could disclose sensitive information to a local user due to insecure permission settings. IBM X-Force ID: 229450.CVE-2022-343155.4IBM CICS TX 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thu CVE-2022-343165.3IBM CICS TX 11.1 does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser compone