https://bugzilla.redhat.com/show_bug.cgi?id=2102817
Bug ID: 2102817
Summary: CVE-2022-34305 tomcat: XSS in examples web application
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: pdelbell(a)redhat.com
CC: aileenc(a)redhat.com, alee(a)redhat.com,
chazlett(a)redhat.com, coolsvap(a)gmail.com,
csutherl(a)redhat.com, gmalinko(a)redhat.com,
gzaronikas(a)gmail.com, huwang(a)redhat.com,
ivan.afonichev(a)gmail.com, janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jclere(a)redhat.com, jochrist(a)redhat.com,
jpavlik(a)redhat.com, jwon(a)redhat.com,
krathod(a)redhat.com, krzysztof.daniel(a)gmail.com,
mmadzin(a)redhat.com, pdelbell(a)redhat.com,
peholase(a)redhat.com, pjindal(a)redhat.com,
rhcs-maint(a)redhat.com, szappis(a)redhat.com
Blocks: 2102443
Target Milestone: ---
Classification: Other
In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to
9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web
application displayed user provided data without filtering, exposing a XSS
vulnerability.
https://lists.apache.org/thread/k04zk0nq6w57m72w5gb0r6z9ryhmvr4k
http://www.openwall.com/lists/oss-security/2022/06/23/1
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2102817