CVE-2022-45143 Apache Tomcat: JsonErrorReportValve escaping

High 7.5 Published 3 Jan 2023 Updated 3 Aug 2024

Attackers can inject malicious scripts into JSON error responses via unescaped user data in Apache Tomcat's JsonErrorReportValve, potentially leading to XSS.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-45143?

CVE-2022-45143 is a high-severity cross-site scripting vulnerability in Apache Tomcat, published on 3 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.

Weakness: CWE-116

Which versions are affected by CVE-2022-45143?

13 open source packages ship an affected version, including org.apache.tomcat.embed:tomcat-embed-core, tomcat and org.apache.tomcat:tomcat-catalina. It affects 1 product.

Package	Affected	Fixed in
`org.apache.tomcat.embed:tomcat-embed-core` Maven	From `10.1.0`	`10.1.2`
`org.apache.tomcat.embed:tomcat-embed-core` Maven	From `10.1.0`	`10.1.2`
`org.apache.tomcat.embed:tomcat-embed-core` Maven	From `8.5.83`	`8.5.84`
`org.apache.tomcat.embed:tomcat-embed-core` Maven	From `8.5.83`	`8.5.84`
`org.apache.tomcat.embed:tomcat-embed-core` Maven	From `9.0.40`	`9.0.69`
`org.apache.tomcat.embed:tomcat-embed-core` Maven	From `9.0.40`	`9.0.69`

7 more packages

`tomcat` Bitnami	From `9.0.40`	`9.0.69, 8.5.84, 10.1.2`
`org.apache.tomcat:tomcat-catalina` Maven	From `10.1.0`	`10.1.2`
`org.apache.tomcat:tomcat-catalina` Maven	From `10.1.0`	`10.1.2`
`org.apache.tomcat:tomcat-util` Maven	From `8.5.83`	`8.5.84`
`org.apache.tomcat:tomcat-util` Maven	From `8.5.83`	`8.5.84`
`org.apache.tomcat:tomcat-util` Maven	From `9.0.40`	`9.0.69`
`org.apache.tomcat:tomcat-util` Maven	From `9.0.40`	`9.0.69`

Linux distribution packages (13)

`tomcat` SUSE:Enterprise Storage 7	All versions	`9.0.43-150200.38.1`
`tomcat` SUSE:Enterprise Storage 7.1	All versions	`9.0.43-150200.38.1`
`tomcat` SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS	All versions	`9.0.43-150200.38.1`
`tomcat` SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS	All versions	`9.0.43-150200.38.1`
`tomcat` SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS	All versions	`9.0.43-150200.38.1`
`tomcat` SUSE:Linux Enterprise Module for Web and Scripting 15 SP4	All versions	`9.0.43-150200.38.1`
`tomcat` SUSE:Linux Enterprise Server 15 SP2-LTSS	All versions	`9.0.43-150200.38.1`
`tomcat` SUSE:Linux Enterprise Server 15 SP3-LTSS	All versions	`9.0.43-150200.38.1`
`tomcat` SUSE:Linux Enterprise Server for SAP Applications 15 SP2	All versions	`9.0.43-150200.38.1`
`tomcat` SUSE:Linux Enterprise Server for SAP Applications 15 SP3	All versions	`9.0.43-150200.38.1`
`tomcat` SUSE:Manager Server 4.2	All versions	`9.0.43-150200.38.1`
`tomcat` openSUSE:Leap 15.4	All versions	`9.0.43-150200.38.1`
`tomcat` openSUSE:Tumbleweed	All versions	`9.0.43-16.1`

Products include Apache Tomcat.

How do I fix CVE-2022-45143?

Upgrade org.apache.tomcat.embed:tomcat-embed-core to a fixed version for your release line: 10.1.2, 8.5.84 or 9.0.69.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2022-45143 being exploited?

There is no known exploitation of CVE-2022-45143 in the wild and no public exploit code.

All Apache Tomcat vulnerabilities

Sources

Also known as BIT-tomcat-2022-45143, CLEANSTART-2026-NO70924, DEBIAN-CVE-2022-45143, GHSA-rq2w-37h9-vg94, ROOT-APP-MAVEN-CVE-2022-45143, SUSE-SU-2023:1853-1 and 2 more.