{"answers":{"affected":"9 open source packages ship an affected version, including org.apache.tomcat:tomcat and tomcat. It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-34305 exists.","fix":"Upgrade org.apache.tomcat:tomcat to a fixed version for your release line: 10.0.22, 10.1.0-M17, 8.5.82 or 9.0.65.","what":"CVE-2022-34305 is a medium-severity cross-site scripting vulnerability in Apache Tomcat, published on 23 Jun 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2022-34305 and fix it if it is affected.\n\nWhat it is: CVE-2022-34305 is a medium-severity cross-site scripting vulnerability in Apache Tomcat, published on 23 Jun 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-34305 exists.\n\nAffected packages and fixed versions:\n- org.apache.tomcat:tomcat (Maven): affected from 10.0.0-M1; fixed in 10.0.22\n- org.apache.tomcat:tomcat (Maven): affected from 10.0.0-M1; fixed in 10.0.22\n- org.apache.tomcat:tomcat (Maven): affected from 10.1.0-M1; fixed in 10.1.0-M17\n- org.apache.tomcat:tomcat (Maven): affected from 10.1.0-M1; fixed in 10.1.0-M17\n- org.apache.tomcat:tomcat (Maven): affected from 8.5.50; fixed in 8.5.82\n- org.apache.tomcat:tomcat (Maven): affected from 8.5.50; fixed in 8.5.82\n- org.apache.tomcat:tomcat (Maven): affected from 9.0.30; fixed in 9.0.65\n- org.apache.tomcat:tomcat (Maven): affected from 9.0.30; fixed in 9.0.65\n- tomcat (Bitnami): affected from 8.5.50; fixed in 8.5.82, 9.0.65, 10.0.23\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2022-34305/ (Markdown: https://insights.sbomify.com/CVE-2022-34305/index.md)","id":"CVE-2022-34305","markdown":"https://insights.sbomify.com/CVE-2022-34305/index.md","name":"CVE-2022-34305","record":{"aliases":["BIT-tomcat-2022-34305","CLEANSTART-2026-EU30316","CLSA-2026-1787564106","DEBIAN-CVE-2022-34305","GHSA-6j88-6whg-x687","UBUNTU-CVE-2022-34305"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["code_execution","account_takeover"],"network_reachable":"yes","non_default_config":true,"product_category":"Apache Tomcat","requires_auth":"none","summary":"Cross-site scripting in the Tomcat examples web application allows attackers to execute scripts in user browsers, requiring the examples app to be enabled.","user_interaction":"required","vuln_class":"xss"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"apache","cpe":[{"product":"tomcat","vendor":"apache"}],"cvss":{"score":6.1,"severity":"medium","source":"nvd","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"description":"In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.","ecosystems":["Bitnami","Maven"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":1,"refs":[{"date":null,"kind":"nuclei","ref":"http/cves/2022/CVE-2022-34305.yaml","stars":null,"title":"Apache Tomcat Examples Web Application - Cross-Site Scripting"}],"tier":"weaponised"},"has_fix":true,"headline":"XSS in examples web application","id":"CVE-2022-34305","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Bitnami","product":"apache:tomcat","products":["apache:tomcat"],"type":"xss","year":"2022"},"n_packages":9,"n_references":4,"next":{"headline":"Cross-site scripting in CICS TX Advanced","id":"CVE-2022-34306"},"packages":[{"ecosystem":"Bitnami","fixed":["8.5.82","9.0.65","10.0.23"],"introduced":["8.5.50","9.0.30","10.0.0"],"last_affected":[],"package":"tomcat","purl":"pkg:bitnami/tomcat","source":"BIT-tomcat-2022-34305"},{"ecosystem":"Maven","fixed":["10.0.22"],"introduced":["10.0.0-M1"],"last_affected":[],"package":"org.apache.tomcat:tomcat","purl":null,"source":"GHSA-6j88-6whg-x687"},{"ecosystem":"Maven","fixed":["10.0.22"],"introduced":["10.0.0-M1"],"last_affected":[],"package":"org.apache.tomcat:tomcat","purl":"pkg:maven/org.apache.tomcat/tomcat","source":"GHSA-6j88-6whg-x687"},{"ecosystem":"Maven","fixed":["10.1.0-M17"],"introduced":["10.1.0-M1"],"last_affected":[],"package":"org.apache.tomcat:tomcat","purl":null,"source":"GHSA-6j88-6whg-x687"},{"ecosystem":"Maven","fixed":["10.1.0-M17"],"introduced":["10.1.0-M1"],"last_affected":[],"package":"org.apache.tomcat:tomcat","purl":"pkg:maven/org.apache.tomcat/tomcat","source":"GHSA-6j88-6whg-x687"},{"ecosystem":"Maven","fixed":["8.5.82"],"introduced":["8.5.50"],"last_affected":[],"package":"org.apache.tomcat:tomcat","purl":null,"source":"GHSA-6j88-6whg-x687"},{"ecosystem":"Maven","fixed":["8.5.82"],"introduced":["8.5.50"],"last_affected":[],"package":"org.apache.tomcat:tomcat","purl":"pkg:maven/org.apache.tomcat/tomcat","source":"GHSA-6j88-6whg-x687"},{"ecosystem":"Maven","fixed":["9.0.65"],"introduced":["9.0.30"],"last_affected":[],"package":"org.apache.tomcat:tomcat","purl":null,"source":"GHSA-6j88-6whg-x687"},{"ecosystem":"Maven","fixed":["9.0.65"],"introduced":["9.0.30"],"last_affected":[],"package":"org.apache.tomcat:tomcat","purl":"pkg:maven/org.apache.tomcat/tomcat","source":"GHSA-6j88-6whg-x687"}],"prev":{"headline":"Security feature bypass in n/a","id":"CVE-2022-34303"},"products":["Apache Tomcat"],"published":"2022-06-23","related":[{"cvss_score":10,"headline":"Apache Tomcat Path Equivalence","id":"CVE-2025-24813","kev_date_added":"2025-04-01","published":"2025-03-10"},{"cvss_score":9.8,"headline":"Apache Tomcat Remote Code Execution","id":"CVE-2016-8735","kev_date_added":"2023-05-12","published":"2017-04-06"},{"cvss_score":8.1,"headline":"Apache Tomcat Remote Code Execution","id":"CVE-2017-12617","kev_date_added":"2022-03-25","published":"2017-10-03"},{"cvss_score":8.1,"headline":"Apache Tomcat on Windows Remote Code Execution","id":"CVE-2017-12615","kev_date_added":"2022-03-25","published":"2017-09-19"},{"cvss_score":7.5,"headline":"Apache Tomcat Missing Encryption of Sensitive Data","id":"CVE-2026-34486","kev_date_added":"2026-08-04","published":"2026-04-09"},{"cvss_score":9.8,"headline":"Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete","id":"CVE-2026-65637","kev_date_added":null,"published":"2026-08-25"},{"cvss_score":9.8,"headline":"Apache Tomcat: Limited replay attack possible with DIGEST authentication","id":"CVE-2026-65905","kev_date_added":null,"published":"2026-08-25"}],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"Bitnami","prefix":"BIT"},{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"attribution","licence":"MIT","name":"Nuclei templates"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-08","vendors":["Apache Software Foundation"]},"summary":"Cross-site scripting in the Tomcat examples web application allows attackers to execute scripts in user browsers, requiring the examples app to be enabled.","url":"https://insights.sbomify.com/CVE-2022-34305/"}