{"id":"CVE-2022-34305","summary":"XSS in examples web application","details":"In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.","aliases":["BIT-tomcat-2022-34305","GHSA-6j88-6whg-x687"],"modified":"2026-08-12T03:30:29.205914877Z","published":"2022-06-23T10:30:16Z","database_specific":{"unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"Apache Tomcat 8.5 8.5.50 to 8.5.81"},{"last_affected":"Apache Tomcat 8.5 8.5.50 to 8.5.81"},{"introduced":"Apache Tomcat 9 9.0.30 to 9.0.64"},{"last_affected":"Apache Tomcat 9 9.0.30 to 9.0.64"},{"introduced":"Apache Tomcat 10.0 10.0.0-M1 to 10.0.22"},{"last_affected":"Apache Tomcat 10.0 10.0.0-M1 to 10.0.22"},{"introduced":"Apache Tomcat 10.1 10.1.0-M1 to 10.1.0-M16"},{"last_affected":"Apache Tomcat 10.1 10.1.0-M1 to 10.1.0-M16"}]}],"cna_assigner":"apache","cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/34xxx/CVE-2022-34305.json"},"references":[{"type":"WEB","url":"https://lists.apache.org/thread/k04zk0nq6w57m72w5gb0r6z9ryhmvr4k"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/34xxx/CVE-2022-34305.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-34305"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202208-34"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20220729-0006/"},{"type":"ARTICLE","url":"http://www.openwall.com/lists/oss-security/2022/06/23/1"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/tomcat","events":[{"introduced":"c40ede65ea4fb44b1957ec482f28c7afa71f1b50"},{"last_affected":"2f283f89f49be662efa45af2c6a876d897159ddf"},{"introduced":"4fab4cc012d0c31852e957d198cb0549f3d6074c"},{"last_affected":"1419d61f200be876baddb0997919fb82c230a857"},{"introduced":"4c8b650437e2464c1c31c6598a263b3805b7a81f"},{"last_affected":"babca1854c6f7068069d501e7f6b9cca13943056"},{"introduced":"f2ab9ac8bc3f40ee9b2cb50b030c99df927f0429"},{"last_affected":"02d546ba3c553c74ff1a99ecc166a6ff9c501ba8"}],"database_specific":{"extracted_events":[{"introduced":"8.5.50"},{"last_affected":"8.5.81"},{"introduced":"9.0.30"},{"last_affected":"9.0.64"},{"introduced":"10.0.0"},{"last_affected":"10.0.22"},{"introduced":"10.1.0-milestone1"},{"last_affected":"10.1.0-milestone1"},{"introduced":"10.1.0-milestone10"},{"last_affected":"10.1.0-milestone10"},{"introduced":"10.1.0-milestone11"},{"last_affected":"10.1.0-milestone11"},{"introduced":"10.1.0-milestone12"},{"last_affected":"10.1.0-milestone12"},{"introduced":"10.1.0-milestone13"},{"last_affected":"10.1.0-milestone13"},{"introduced":"10.1.0-milestone14"},{"last_affected":"10.1.0-milestone14"},{"introduced":"10.1.0-milestone15"},{"last_affected":"10.1.0-milestone15"},{"introduced":"10.1.0-milestone16"},{"last_affected":"10.1.0-milestone16"},{"introduced":"10.1.0-milestone2"},{"last_affected":"10.1.0-milestone2"},{"introduced":"10.1.0-milestone3"},{"last_affected":"10.1.0-milestone3"},{"introduced":"10.1.0-milestone4"},{"last_affected":"10.1.0-milestone4"},{"introduced":"10.1.0-milestone5"},{"last_affected":"10.1.0-milestone5"},{"introduced":"10.1.0-milestone6"},{"last_affected":"10.1.0-milestone6"},{"introduced":"10.1.0-milestone7"},{"last_affected":"10.1.0-milestone7"},{"introduced":"10.1.0-milestone8"},{"last_affected":"10.1.0-milestone8"},{"introduced":"10.1.0-milestone9"},{"last_affected":"10.1.0-milestone9"}],"source":["CPE_RANGE","CPE_STRING"],"cpe":["cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone1:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone10:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone11:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone12:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone13:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone14:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone15:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone16:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone2:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone3:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone4:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone5:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone6:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone7:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone8:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone9:*:*:*:*:*:*"]}}],"versions":["10.1.0-milestone1","10.1.0-milestone10","10.1.0-milestone11","10.1.0-milestone12","10.1.0-milestone13","10.1.0-milestone14","10.1.0-milestone15","10.1.0-milestone16","10.1.0-milestone2","10.1.0-milestone3","10.1.0-milestone4","10.1.0-milestone5","10.1.0-milestone6","10.1.0-milestone7","10.1.0-milestone8","10.1.0-milestone9"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-34305.json"}}],"schema_version":"1.9.0"}