What’s Vulnerable › Vulnerabilities

CVE-2022-45143: Apache Tomcat: JsonErrorReportValve escaping

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-01-03 · updated 2026-06-17
• Weakness: CWE-116

Description

The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.

Affected products

• Apache Tomcat: from 9.0.40 before 9.0.69; 8.5.83, 10.1.0-milestone1, 10.1.0-milestone10, 10.1.0-milestone11, 10.1.0-milestone12, 10.1.0-milestone13 (+13) — fixed in 9.0.69

How to fix

Upgrade to a fixed version: Apache Tomcat 9.0.69. Check the vendor advisory for mitigations.

References

• https://lists.apache.org/thread/yqkd183xrw3wqvnpcg3osbcryq85fkzj
• https://security.gentoo.org/glsa/202305-37
• https://lists.apache.org/thread/yqkd183xrw3wqvnpcg3osbcryq85fkzj
• https://security.gentoo.org/glsa/202305-37
• https://security.netapp.com/advisory/ntap-20230216-0009/

Get alerted when CVE-2022-45143 or the next vulnerability affects your stack