CVE-2022-45143— Apache Tomcat: JsonErrorReportValve escaping
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2022-45143
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Tomcat: JsonErrorReportValve escaping
Source: NVD (National Vulnerability Database)
Vulnerability Description
The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
对输出编码和转义不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
Apache Tomcat 注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Tomcat是美国阿帕奇（Apache）基金会的一款轻量级Web应用服务器。该程序实现了对Servlet和JavaServer Page（JSP）的支持。 Apache Tomcat 8.5.83版本、9.0.40版本至9.0.68版本、10.1.0-M1版本至10.1.1版本存在注入漏洞，该漏洞源于JsonErrorReportValve没有转义类型、消息或描述值。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Tomcat | 10.1.0-M1 ~ 10.1.1 | - |
II. Public POCs for CVE-2022-45143
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-45143
请登录查看更多情报信息。
Vendor Advisories for CVE-2022-45143 (1)
Mailing List Discussions for CVE-2022-45143 (1)
IV. Related Vulnerabilities
Same product: Apache Tomcat
- CVE-2026-43515
Apache Tomcat: Security constraints not correctly applied - CVE-2026-43514
Apache Tomcat: AJP secret compared in non-constant time - CVE-2026-43513
Apache Tomcat: LockOutRealm treats user names as case-sensit - CVE-2026-43512
Apache Tomcat: Digest authenticator will authenticate any un - CVE-2026-41293
Apache Tomcat: HTTP/2 request headers not validated
Same vendor: Apache Software Foundation
- CVE-2026-46745
Apache Airflow FAB provider: LDAP Filter Injection in FAB Au - CVE-2026-45361
Apache Airflow Google provider: SSH host key verification di - CVE-2026-45249
Apache ECharts: XSS in Lines series tooltip rendering - CVE-2026-44417
Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS - CVE-2026-44618
Apache CXF: XXE vulnerability in WS-Transfer functionality
Same weakness: CWE-116
- CVE-2026-9354
NousResearch hermes-agent Slack Agent/Mattermost Agent escap - CVE-2026-26028
CryptPad: Sanitizer Bypass in Diffmarked.js Allows Arbitrary - CVE-2026-42810
Apache Polaris: could broaden vended S3 credentials through - CVE-2026-42040
Axios: Null Byte Injection via Reverse-Encoding in AxiosURLS - CVE-2026-40567
FreeScout has HTML Injection in Outgoing Emails via Unsaniti
V. Comments for CVE-2022-45143
No comments yet