Tracker / CVE-2022-34305
CVE-2022-34305
Medium 6.1
In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.
Affected products and versions
| apache | tomcat |
|---|---|
| apache | tomcat · 10.0.0 → 10.0.22 |
| apache | tomcat · 8.5.50 → 8.5.81 |
| apache | tomcat · 9.0.30 → 9.0.64 |
Analysis
This page is not indexable yet.Until it carries original analysis — what it actually exposes, how to check in two minutes whether a system was touched, what to do if it was — the page stays noindex. The database decides that, not the template.