CVE-2022-34305
Fixed in a distro release EPSS 7%
In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.
Products: Apache Software Foundation Apache Tomcat
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.tomcat:tomcat | 10.1.0-M17 |
| Maven | org.apache.tomcat:tomcat | 10.0.22 |
| Maven | org.apache.tomcat:tomcat | 9.0.65 |
| Maven | org.apache.tomcat:tomcat | 8.5.82 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | tomcat9 | 9.0.65-1 |
| Debian 13 | tomcat9 | 9.0.65-1 |
| Debian 14 | tomcat9 | 9.0.65-1 |
| Ubuntu Pro 20.04 LTS | tomcat9 | no fix |
| Ubuntu Pro 22.04 LTS | tomcat9 | no fix |