high 7.5

CVE-2022-45143 json

Apache Tomcat: JsonErrorReportValve escaping

published 2023-01-03 3 y ago modified 2026-09-08 2 mo ago also BIT-tomcat-2022-45143 , EUVD-2023-0546 , GHSA-rq2w-37h9-vg94

cvss: 7.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 2.7%; EPSS 2.7% chance of exploitation in 30 days, percentile 85%
public exploits: 0; none known

The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.

Patch / fix

fixed in 5 distros 5 links 3

maven org.apache.tomcat.embed:tomcat-embed-core 8.5.84, 9.0.69, 10.1.2
maven org.apache.tomcat:tomcat-catalina 10.1.2
maven org.apache.tomcat:tomcat-util 8.5.84, 9.0.69
bitnami tomcat 8.5.84, 9.0.69, 10.1.2
apache tomcat 9.0.69

debian red hat suse opensuse almalinux

tomcat9 Debian 14, Debian 13, Debian 12 9.0.70-1

debian advisories DEBIAN-CVE-2022-45143

tomcat RHEL 8 1:9.0.87-1.el8_10.1
tomcat-lib RHEL 8 1:9.0.87-1.el8_10.1
tomcat-webapps RHEL 8 1:9.0.87-1.el8_10.1
tomcat-el-3.0-api RHEL 8 1:9.0.87-1.el8_10.1
tomcat-docs-webapp RHEL 8 1:9.0.87-1.el8_10.1
tomcat-jsp-2.3-api RHEL 8 1:9.0.87-1.el8_10.1
tomcat-admin-webapps RHEL 8 1:9.0.87-1.el8_10.1
tomcat-servlet-4.0-api RHEL 8 1:9.0.87-1.el8_10.1

red hat advisories RHSA-2024:3814 RHSA-2024:3666 RHSA-2024:3307 RHSA-2023:1663

tomcat SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES 15 SP3-LTSS +9 more 9.0.43-150200.38.1

suse advisories SUSE-SU-2023:1853-1

tomcat openSUSE Tumbleweed 9.0.43-16.1
tomcat10 openSUSE Tumbleweed 10.1.14-1.1

opensuse advisories openSUSE-SU-2024:12847-1 openSUSE-SU-2024:13441-1

tomcat AlmaLinux 8 1:9.0.87-1.el8_10.1.alma.1
tomcat-lib AlmaLinux 8 1:9.0.87-1.el8_10.1.alma.1
tomcat-webapps AlmaLinux 8 1:9.0.87-1.el8_10.1.alma.1
tomcat-el-3.0-api AlmaLinux 8 1:9.0.87-1.el8_10.1.alma.1
tomcat-docs-webapp AlmaLinux 8 1:9.0.87-1.el8_10.1.alma.1
tomcat-jsp-2.3-api AlmaLinux 8 1:9.0.87-1.el8_10.1.alma.1
tomcat-admin-webapps AlmaLinux 8 1:9.0.87-1.el8_10.1.alma.1
tomcat-servlet-4.0-api AlmaLinux 8 1:9.0.87-1.el8_10.1.alma.1

almalinux advisories ALSA-2024:3666

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-45143 updated 2026-11-07 cvss 7.5

tomcat: JsonErrorReportValve injection

Red Hat Enterprise Linux 6 tomcat6, tomcat6-lib, tomcat6-log4j, tomcat6-javadoc, tomcat6-webapps, tomcat6-el-2.1-api, +4 more Red Hat Enterprise Linux 7 tomcat, tomcat-lib, tomcat-jsvc, tomcat-javadoc, tomcat-webapps, tomcat-el-2.2-api, +4 more
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux 8 pki-servlet-engine, pki-servlet-4.0-api Red Hat Enterprise Linux 9 pki-servlet-engine, pki-servlet-4.0-api
affected: no fix available “Fix deferred”
Red Hat JBoss Web Server 3 tomcat8 tomcat8 Red Hat Process Automation 7 tomcat
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux AppStream (v. 8) tomcat 9.0.87-1.el8_10.1, tomcat-lib 9.0.87-1.el8_10.1, tomcat-webapps 9.0.87-1.el8_10.1, tomcat-el-3.0-api 9.0.87-1.el8_10.1, tomcat-docs-webapp 9.0.87-1.el8_10.1, tomcat-jsp-2.3-api 9.0.87-1.el8_10.1, +2 more
fixed: vendor fix RHSA-2024:3666
Red Hat Enterprise Linux AppStream (v. 9) tomcat 9.0.87-1.el9_4.1, tomcat-lib 9.0.87-1.el9_4.1, tomcat-webapps 9.0.87-1.el9_4.1, tomcat-el-3.0-api 9.0.87-1.el9_4.1, tomcat-docs-webapp 9.0.87-1.el9_4.1, tomcat-jsp-2.3-api 9.0.87-1.el9_4.1, +2 more
fixed: vendor fix RHSA-2024:3307
Red Hat Enterprise Linux AppStream EUS (v.8.8) tomcat 9.0.87-1.el8_8.2, tomcat-lib 9.0.87-1.el8_8.2, tomcat-webapps 9.0.87-1.el8_8.2, tomcat-el-3.0-api 9.0.87-1.el8_8.2, tomcat-docs-webapp 9.0.87-1.el8_8.2, tomcat-jsp-2.3-api 9.0.87-1.el8_8.2, +2 more
fixed: vendor fix RHSA-2024:3814
Red Hat Fuse 7.12
fixed: vendor fix RHSA-2023:3954
Red Hat JBoss Web Server 5
fixed: vendor fix RHSA-2023:1664

show 3 more

Red Hat JBoss Web Server 5.7 for RHEL 7 Server jws5-tomcat 9.0.62-13.redhat_00011.1.el7jws, jws5-tomcat-lib 9.0.62-13.redhat_00011.1.el7jws, jws5-tomcat-javadoc 9.0.62-13.redhat_00011.1.el7jws, jws5-tomcat-selinux 9.0.62-13.redhat_00011.1.el7jws, jws5-tomcat-webapps 9.0.62-13.redhat_00011.1.el7jws, jws5-tomcat-java-jdk8 9.0.62-13.redhat_00011.1.el7jws, +6 more Red Hat JBoss Web Server 5.7 for RHEL 8 jws5-tomcat 9.0.62-13.redhat_00011.1.el8jws, jws5-tomcat-lib 9.0.62-13.redhat_00011.1.el8jws, jws5-tomcat-javadoc 9.0.62-13.redhat_00011.1.el8jws, jws5-tomcat-selinux 9.0.62-13.redhat_00011.1.el8jws, jws5-tomcat-webapps 9.0.62-13.redhat_00011.1.el8jws, jws5-tomcat-el-3.0-api 9.0.62-13.redhat_00011.1.el8jws, +4 more Red Hat JBoss Web Server 5.7 for RHEL 9 jws5-tomcat 9.0.62-13.redhat_00011.1.el9jws, jws5-tomcat-lib 9.0.62-13.redhat_00011.1.el9jws, jws5-tomcat-javadoc 9.0.62-13.redhat_00011.1.el9jws, jws5-tomcat-selinux 9.0.62-13.redhat_00011.1.el9jws, jws5-tomcat-webapps 9.0.62-13.redhat_00011.1.el9jws, jws5-tomcat-el-3.0-api 9.0.62-13.redhat_00011.1.el9jws, +4 more
fixed: vendor fix RHSA-2023:1663
Red Hat support for Spring Boot 2.7.13
fixed: vendor fix RHSA-2023:4612
Red Hat build of Apache Camel for Spring Boot 3 tomcat Red Hat Data Grid 8 tomcat Red Hat Integration Camel K 1 tomcat Red Hat Integration Camel Quarkus 1 tomcat Red Hat JBoss Enterprise Application Platform 7 tomcat Red Hat JBoss Enterprise Application Platform Expansion Pack tomcat

+2 more productsfewer

Red Hat JBoss Web Server 3 tomcat, tomcat7 tomcat7 Red Hat Single Sign-On 7 tomcat

not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-08-01)

Exploit prediction

2.67% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
GitHub	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
OSV	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
maven	org.apache.tomcat.embed:tomcat-embed-core	>=8.5.83, <8.5.84 >=9.0.40, <9.0.69 >=10.1.0, <10.1.2	8.5.84 9.0.69 10.1.2
maven	org.apache.tomcat:tomcat-catalina	>=10.1.0, <10.1.2	10.1.2
maven	org.apache.tomcat:tomcat-util	>=8.5.83, <8.5.84 >=9.0.40, <9.0.69	8.5.84 9.0.69
bitnami	tomcat	>=9.0.40, <9.0.69 >=8.5.83, <8.5.84 >=10.1.1, <10.1.2	9.0.69 8.5.84 10.1.2

Affected products

Apache Software Foundation Apache Tomcat

Classification

Weakness

CWE-116 Improper Encoding or Escaping of Output
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component

References

github.com /apache/tomcat/commit/0cab3a56bd89f70e7481bb0d68395dc7e130dbbf
web
github.com /apache/tomcat/commit/6a0ac6a438cbbb66b6e9c5223842f53bf0cb50aa
web
github.com /apache/tomcat/commit/b336f4e58893ea35114f1e4a415657f723b1298e
web
lists.apache.org /thread/yqkd183xrw3wqvnpcg3osbcryq85fkzj
vendor-advisory, web, mailing-list, advisory
security.gentoo.org /glsa/202305-37
web, third-party-advisory, advisory
security.netapp.com /advisory/ntap-20230216-0009/
web
nvd.nist.gov /vuln/detail/CVE-2022-45143
advisory, web
github.com /apache/tomcat
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary