« Volver al listado

CVE-2022-45143

Estado: ModificadaAlta (7.5)—

The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Apache — Tomcat

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-45143",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-45143",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-01T14:55:21.394332Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Tomcat",
          "versions": [
            {
              "status": "affected",
              "version": "10.1.0-M1",
              "versionType": "semver",
              "lessThanOrEqual": "10.1.1"
            },
            {
              "status": "affected",
              "version": "9.0.40",
              "versionType": "semver",
              "lessThanOrEqual": "9.0.68"
            },
            {
              "status": "affected",
              "version": "8.5.83"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2023-01-03T19:15:10.403",
  "references": [
    {
      "url": "https://lists.apache.org/thread/yqkd183xrw3wqvnpcg3osbcryq85fkzj",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://security.gentoo.org/glsa/202305-37",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread/yqkd183xrw3wqvnpcg3osbcryq85fkzj",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.gentoo.org/glsa/202305-37",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20230216-0009/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@apache.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-116"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-116"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output."
    },
    {
      "lang": "es",
      "value": "JsonErrorReportValve en Apache Tomcat 8.5.83, 9.0.40 a 9.0.68 y 10.1.0-M1 a 10.1.1 no escapó de los valores de tipo, mensaje o descripción. En algunas circunstancias, estos se construyen a partir de datos proporcionados por el usuario y, por lo tanto, era posible que los usuarios proporcionaran valores que invalidaban o manipulaban la salida JSON."
    }
  ],
  "lastModified": "2026-06-17T05:09:27.230",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "24BAD725-BA56-4B40-9BFA-1B6B99348F7D",
              "versionEndExcluding": "9.0.69",
              "versionStartIncluding": "9.0.40"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:8.5.83:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7BA74802-4328-4AB7-AE53-7118C3EA5018"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6D402B5D-5901-43EB-8E6A-ECBD512CE367"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone10:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "33C71AE1-B38E-4783-BAC2-3CDA7B4D9EBA"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone11:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F6BD4180-D3E8-42AB-96B1-3869ECF47F6C"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone12:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "64668CCF-DBC9-442D-9E0F-FD40E1D0DDB7"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone13:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FC64BB57-4912-481E-AE8D-C8FCD36142BB"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone14:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "49B43BFD-6B6C-4E6D-A9D8-308709DDFB44"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone15:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "919C16BD-79A7-4597-8D23-2CBDED2EF615"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone16:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "81B27C03-D626-42EC-AE4E-1E66624908E3"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone17:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BD81405D-81A5-4683-A355-B39C912DAD2D"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9846609D-51FC-4CDD-97B3-8C6E07108F14"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2E321FB4-0B0C-497A-BB75-909D888C93CB"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3B0CAE57-AF7A-40E6-9519-F5C9F422C1BE"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7CB9D150-EED6-4AE9-BCBE-48932E50035E"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D334103F-F64E-4869-BCC8-670A5AFCC76C"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "941FCF7B-FFB6-4967-95C7-BB3D32C73DAF"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CE1A9030-B397-4BA6-8E13-DA1503872DDB"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6284B74A-1051-40A7-9D74-380FEEEC3F88"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:10.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A8FEA1A6-0E39-4099-ABC4-73B921FE5C4F"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@apache.org"
}