CVE-2022-34305

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-34305
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-34305.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-34305
Aliases
Downstream
CLEANSTART (21)
CLSA (5)
DEBIAN (1)
MGASA (1)
UBUNTU (1)
Published
2022-06-23T10:30:16Z
Modified
2026-10-16T02:51:40Z
Summary
XSS in examples web application
Details

In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.

Database specific 
{
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/34xxx/CVE-2022-34305.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "Apache Tomcat 8.5 8.5.50 to 8.5.81"
                        },
                        {
                            "last_affected": "Apache Tomcat 8.5 8.5.50 to 8.5.81"
                        },
                        {
                            "introduced": "Apache Tomcat 9 9.0.30 to 9.0.64"
                        },
                        {
                            "last_affected": "Apache Tomcat 9 9.0.30 to 9.0.64"
                        },
                        {
                            "introduced": "Apache Tomcat 10.0 10.0.0-M1 to 10.0.22"
                        },
                        {
                            "last_affected": "Apache Tomcat 10.0 10.0.0-M1 to 10.0.22"
                        },
                        {
                            "introduced": "Apache Tomcat 10.1 10.1.0-M1 to 10.1.0-M16"
                        },
                        {
                            "last_affected": "Apache Tomcat 10.1 10.1.0-M1 to 10.1.0-M16"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandaloneSingleVersion"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/apache/tomcat

Affected ranges

Type
GIT
Repo
https://github.com/apache/tomcat
Events
Introduced
c40ede65ea4fb44b1957ec482f28c7afa71f1b50
Last Affected
2f283f89f49be662efa45af2c6a876d897159ddf
Introduced
4fab4cc012d0c31852e957d198cb0549f3d6074c
Last Affected
1419d61f200be876baddb0997919fb82c230a857
Introduced
4c8b650437e2464c1c31c6598a263b3805b7a81f
Last Affected
babca1854c6f7068069d501e7f6b9cca13943056
Introduced
f2ab9ac8bc3f40ee9b2cb50b030c99df927f0429
Last Affected
02d546ba3c553c74ff1a99ecc166a6ff9c501ba8
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "8.5.50"
                },
                {
                    "last_affected": "8.5.81"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "9.0.30"
                },
                {
                    "last_affected": "9.0.64"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.0.0"
                },
                {
                    "last_affected": "10.0.22"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone1:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.1.0-milestone1"
                },
                {
                    "last_affected": "10.1.0-milestone1"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone10:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.1.0-milestone10"
                },
                {
                    "last_affected": "10.1.0-milestone10"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone11:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.1.0-milestone11"
                },
                {
                    "last_affected": "10.1.0-milestone11"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone12:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.1.0-milestone12"
                },
                {
                    "last_affected": "10.1.0-milestone12"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone13:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.1.0-milestone13"
                },
                {
                    "last_affected": "10.1.0-milestone13"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone14:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.1.0-milestone14"
                },
                {
                    "last_affected": "10.1.0-milestone14"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone15:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.1.0-milestone15"
                },
                {
                    "last_affected": "10.1.0-milestone15"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone16:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.1.0-milestone16"
                },
                {
                    "last_affected": "10.1.0-milestone16"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone2:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.1.0-milestone2"
                },
                {
                    "last_affected": "10.1.0-milestone2"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone3:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.1.0-milestone3"
                },
                {
                    "last_affected": "10.1.0-milestone3"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone4:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.1.0-milestone4"
                },
                {
                    "last_affected": "10.1.0-milestone4"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone5:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.1.0-milestone5"
                },
                {
                    "last_affected": "10.1.0-milestone5"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone6:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.1.0-milestone6"
                },
                {
                    "last_affected": "10.1.0-milestone6"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone7:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.1.0-milestone7"
                },
                {
                    "last_affected": "10.1.0-milestone7"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone8:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.1.0-milestone8"
                },
                {
                    "last_affected": "10.1.0-milestone8"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone9:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.1.0-milestone9"
                },
                {
                    "last_affected": "10.1.0-milestone9"
                }
            ],
            "source": "CPE_STRING"
        }
    ]
}

Affected versions

10.*
10.1.0-milestone1
10.1.0-milestone10
10.1.0-milestone11
10.1.0-milestone12
10.1.0-milestone13
10.1.0-milestone14
10.1.0-milestone15
10.1.0-milestone16
10.1.0-milestone2
10.1.0-milestone3
10.1.0-milestone4
10.1.0-milestone5
10.1.0-milestone6
10.1.0-milestone7
10.1.0-milestone8
10.1.0-milestone9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-34305.json"