CVE-2022-34305
XSS in examples web application
In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.
- Record
CVE-2022-34305- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
XSS in examples web application
In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.
- Record
CVE-2022-34305- Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2022-5963 No score
In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.
- Record
EUVD-2022-5963- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6j88-6whg-x687
Cross-site Scripting in Apache Tomcat
In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.
- Record
GHSA-6j88-6whg-x687- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-6j88-6whg-x687
Cross-site Scripting in Apache Tomcat
In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.
- Record
GHSA-6j88-6whg-x687- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-34305
In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.
- Record
UBUNTU-CVE-2022-34305- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Show 11 moreShow less
OSVBIT-tomcat-2022-34305 No score
XSS in examples web application
In Apache Tomcat 10.1.0 to 10.1.0, 10.0.0 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.
- Record
BIT-tomcat-2022-34305- Updated
- 2026-11-02
OSVCLSA-2025-1748282295 No score
Fix of 34 CVEs
- SECURITY UPDATE: Misc vulnerability fixes
- CVE-2019-12418, CVE-2019-17563, CVE-2020-1935, CVE-2020-11996, CVE-2020-13934, CVE-2020-13935, CVE-2020-13943, CVE-2020-17527, CVE-2021-24122, CVE-2021-30639, CVE-2021-30640, CVE-2021-33037, CVE-2021-42340, CVE-2021-43980, CVE-2022-25762, CVE-2022-34305, CVE-2022-45143, CVE-2023-24998, CVE-2023-28709, CVE-2023-34981, CVE-2023-42794, CVE-2024-21733
- Update to 8.5.100
- debian/rules, debian/libtomcat8-java.poms, debian/maven.rules, debian/tomcat8-common.links, debian/patches/0018-fix-manager-webapp.patch, debian/patches/0019-add-distribution-to-error-page.patch, debian/patches/0021-dont-test-unsupported-ciphers.patch, debian/patches/0101-skipping-tests-incompatible-with-firewall.patch: updated
- debian/patches/0002-do-not-load-AJP13-connector-by-default.patch, debian/patches/0026-easymock4-compatibility.patch: removed as they were applied in upstream
- CVE-2019-0221.patch, CVE-2019-10072-1.patch, CVE-2019-10072-2.patch, CVE-2022-42252.patch, CVE-2020-1938.patch, CVE-2021-25122.patch, CVE-2021-41079.patch, CVE-2022-29885.patch, CVE-2020-9484.patch, CVE-2021-25329-pre1.patch, CVE-2021-25329.patch, CVE-2022-23181.patch, CVE-2023-44487.patch, CVE-2023-46589-pre1.patch, CVE-2023-46589-pre2.patch, CVE-2023-46589-pre3.patch, CVE-2023-46589-pre4.patch, CVE-2023-46589.patch: removed because these CVEs were fixed in upstream
- Internal tests
- debian/test_certs/*: updated from upstream branch 9.0.x, as the 8.0.x certs were expired
- Record
CLSA-2025-1748282295- Updated
- 2026-11-02
OSVCLSA-2025-1756253007 No score
TuxCare security update for 5 packages (18 CVEs)
TuxCare rebuilt 5 packages to address 18 CVEs. Fixed in 9.0.75-tuxcare.1.
- Record
CLSA-2025-1756253007- Updated
- 2026-11-02
OSVCLSA-2026-1775003191 No score
TuxCare security update for 4 packages (3 CVEs)
TuxCare rebuilt 4 packages to address 3 CVEs. Fixed in 9.0.46-tuxcare.3.
- Record
CLSA-2026-1775003191- Updated
- 2026-11-02
OSVCLSA-2026-1785917668 No score
TuxCare security update for org.apache.tomcat (3 CVEs)
TuxCare rebuilt 2 org.apache.tomcat packages to address 3 CVEs. Fixed in 7.0.109-tuxcare.4.
- Record
CLSA-2026-1785917668- Updated
- 2026-11-02
OSVCLSA-2026-1787564106 No score
TuxCare security update for org.apache.tomcat:tomcat (1 CVE)
TuxCare rebuilt org.apache.tomcat:tomcat to address 1 CVE. Fixed in 9.0.50-tuxcare.15.
- Record
CLSA-2026-1787564106- Updated
- 2026-11-02
OSVCLSA-2026-1792686128 No score
TuxCare security update for 7 packages (13 CVEs)
TuxCare rebuilt 7 packages to address 13 CVEs. Fixed in 8.5.78-tuxcare.1.
- Record
CLSA-2026-1792686128- Updated
- 2026-11-02
OSVCLSA-2026-1793011037 No score
TuxCare security update for 5 packages (26 CVEs)
TuxCare rebuilt 5 packages to address 26 CVEs. Fixed in 9.0.39-tuxcare.2.
- Record
CLSA-2026-1793011037- Updated
- 2026-11-02
OSV No score
XSS in examples web application
In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.
- Record
CVE-2022-34305- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-34305 No score
In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.
- Record
DEBIAN-CVE-2022-34305- Updated
- 2026-11-03
OSVMGASA-2023-0138 No score
Updated tomcat packages fix security vulnerability
Information disclosure due to concurrency bug (CVE-2021-43980) Fix for CVE-2020-9484 introduced a time of check, time of use vulnerability (CVE-2022-23181) Correct documentation to warn of use over untrusted networks. (CVE-2022-29885) Correct documentation showing use of XSS vulnerability. (CVE-2022-34305) Fix to reject invalid Content-Length header (CVE-2022-42252) Fix escaping of the type, message or description values. (CVE-2022-45143) Fix FileUpload limiting of the number of request parts to be processed to prevent the possibility of an attacker triggering a DoS (CVE-2023-24998) Fix setting of session cookie secure attribute when using RemoteIpFilter with X-Forwarded-Proto header set to https (CVE-2023-28708) Obsolete tomcat-jsvc
- Record
MGASA-2023-0138- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.tomcat:tomcatMaven |
10.1.0-M1 to 10.1.0-M16 | 10.1.0-M17 |
org.apache.tomcat:tomcatMaven |
10.0.0-M1 up to 10.0.22 | 10.0.22 |
org.apache.tomcat:tomcatMaven |
9.0.30 up to 9.0.65 | 9.0.65 |
org.apache.tomcat:tomcatMaven |
8.5.50 up to 8.5.82 | 8.5.82 |
tomcatBitnami |
8.5.50 up to 8.5.82, 9.0.30 up to 9.0.65, 10.0.0 up to 10.0.23 | 8.5.829.0.6510.0.23 |
libtomcat8-embed-javaTuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
libtomcat8-javaTuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
tomcat8TuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
tomcat8-adminTuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
tomcat8-commonTuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
Show 37 moreShow less
| Package | Affected | Fixed |
|---|---|---|
tomcat8-docsTuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
tomcat8-examplesTuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
tomcat8-userTuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
org.apache.tomcat.embed:tomcat-embed-coreTuxCare:Maven |
9.0.75 up to 9.0.75-tuxcare.1 | 9.0.75-tuxcare.1 |
org.apache.tomcat:tomcatTuxCare:Maven |
9.0.75 up to 9.0.75-tuxcare.1 | 9.0.75-tuxcare.1 |
org.apache.tomcat:tomcat-catalinaTuxCare:Maven |
9.0.75 up to 9.0.75-tuxcare.1 | 9.0.75-tuxcare.1 |
org.apache.tomcat:tomcat-coyoteTuxCare:Maven |
9.0.75 up to 9.0.75-tuxcare.1 | 9.0.75-tuxcare.1 |
org.apache.tomcat:tomcat-utilTuxCare:Maven |
9.0.75 up to 9.0.75-tuxcare.1 | 9.0.75-tuxcare.1 |
org.apache.tomcat.embed:tomcat-embed-coreTuxCare:Maven |
9.0.46 up to 9.0.46-tuxcare.3, plus listed versions 9.0.46-tuxcare.19.0.46-tuxcare.2 |
9.0.46-tuxcare.3 |
org.apache.tomcat:tomcatTuxCare:Maven |
9.0.46 up to 9.0.46-tuxcare.3, plus listed versions 9.0.46-tuxcare.19.0.46-tuxcare.2 |
9.0.46-tuxcare.3 |
org.apache.tomcat:tomcat-catalinaTuxCare:Maven |
9.0.46 up to 9.0.46-tuxcare.3, plus listed versions 9.0.46-tuxcare.19.0.46-tuxcare.2 |
9.0.46-tuxcare.3 |
org.apache.tomcat:tomcat-coyoteTuxCare:Maven |
9.0.46 up to 9.0.46-tuxcare.3, plus listed versions 9.0.46-tuxcare.19.0.46-tuxcare.2 |
9.0.46-tuxcare.3 |
org.apache.tomcat:tomcatTuxCare:Maven |
7.0.109 up to 7.0.109-tuxcare.4, plus listed versions 7.0.109-tuxcare.17.0.109-tuxcare.27.0.109-tuxcare.3 |
7.0.109-tuxcare.4 |
org.apache.tomcat:tomcat-tribesTuxCare:Maven |
7.0.109 up to 7.0.109-tuxcare.4, plus listed versions 7.0.109-tuxcare.17.0.109-tuxcare.27.0.109-tuxcare.3 |
7.0.109-tuxcare.4 |
org.apache.tomcat:tomcatTuxCare:Maven |
9.0.50 up to 9.0.50-tuxcare.15, plus listed versions 9.0.50-tuxcare.19.0.50-tuxcare.109.0.50-tuxcare.119.0.50-tuxcare.129.0.50-tuxcare.13 Show 9 moreShow less9.0.50-tuxcare.149.0.50-tuxcare.29.0.50-tuxcare.39.0.50-tuxcare.49.0.50-tuxcare.59.0.50-tuxcare.69.0.50-tuxcare.79.0.50-tuxcare.89.0.50-tuxcare.9 |
9.0.50-tuxcare.15 |
org.apache.tomcat.embed:tomcat-embed-coreTuxCare:Maven |
8.5.78 up to 8.5.78-tuxcare.1 | 8.5.78-tuxcare.1 |
org.apache.tomcat.embed:tomcat-embed-websocketTuxCare:Maven |
8.5.78 up to 8.5.78-tuxcare.1 | 8.5.78-tuxcare.1 |
org.apache.tomcat:tomcatTuxCare:Maven |
8.5.78 up to 8.5.78-tuxcare.1 | 8.5.78-tuxcare.1 |
org.apache.tomcat:tomcat-catalinaTuxCare:Maven |
8.5.78 up to 8.5.78-tuxcare.1 | 8.5.78-tuxcare.1 |
org.apache.tomcat:tomcat-coyoteTuxCare:Maven |
8.5.78 up to 8.5.78-tuxcare.1 | 8.5.78-tuxcare.1 |
org.apache.tomcat:tomcat-tribesTuxCare:Maven |
8.5.78 up to 8.5.78-tuxcare.1 | 8.5.78-tuxcare.1 |
org.apache.tomcat:tomcat-websocketTuxCare:Maven |
8.5.78 up to 8.5.78-tuxcare.1 | 8.5.78-tuxcare.1 |
org.apache.tomcat.embed:tomcat-embed-coreTuxCare:Maven |
9.0.39 up to 9.0.39-tuxcare.2, plus listed versions 9.0.39-tuxcare.1 |
9.0.39-tuxcare.2 |
org.apache.tomcat:tomcatTuxCare:Maven |
9.0.39 up to 9.0.39-tuxcare.2, plus listed versions 9.0.39-tuxcare.1 |
9.0.39-tuxcare.2 |
org.apache.tomcat:tomcat-catalinaTuxCare:Maven |
9.0.39 up to 9.0.39-tuxcare.2, plus listed versions 9.0.39-tuxcare.1 |
9.0.39-tuxcare.2 |
org.apache.tomcat:tomcat-coyoteTuxCare:Maven |
9.0.39 up to 9.0.39-tuxcare.2, plus listed versions 9.0.39-tuxcare.1 |
9.0.39-tuxcare.2 |
org.apache.tomcat:tomcat-utilTuxCare:Maven |
9.0.39 up to 9.0.39-tuxcare.2, plus listed versions 9.0.39-tuxcare.1 |
9.0.39-tuxcare.2 |
tomcat9Debian:12 |
before 9.0.65-1 | 9.0.65-1 |
tomcat9Debian:13 |
before 9.0.65-1 | 9.0.65-1 |
tomcat9Debian:14 |
before 9.0.65-1 | 9.0.65-1 |
org.apache.tomcat:tomcatMaven |
10.1.0-M1 up to 10.1.0-M17, plus listed versions 10.1.0-M1010.1.0-M1110.1.0-M1210.1.0-M1410.1.0-M15 Show 7 moreShow less10.1.0-M1610.1.0-M210.1.0-M410.1.0-M510.1.0-M610.1.0-M710.1.0-M8 |
10.1.0-M17 |
org.apache.tomcat:tomcatMaven |
10.0.0-M1 up to 10.0.22, plus listed versions 10.0.010.0.0-M1010.0.0-M310.0.0-M410.0.0-M5 Show 20 moreShow less10.0.0-M610.0.0-M710.0.0-M810.0.0-M910.0.1010.0.1110.0.1210.0.1310.0.1410.0.1610.0.1710.0.1810.0.210.0.2010.0.2110.0.410.0.510.0.610.0.710.0.8 |
10.0.22 |
org.apache.tomcat:tomcatMaven |
9.0.30 up to 9.0.65, plus listed versions 9.0.319.0.339.0.349.0.359.0.36 Show 22 moreShow less9.0.379.0.389.0.399.0.409.0.419.0.439.0.449.0.459.0.469.0.489.0.509.0.529.0.539.0.549.0.559.0.569.0.589.0.599.0.609.0.629.0.639.0.64 |
9.0.65 |
org.apache.tomcat:tomcatMaven |
8.5.50 up to 8.5.82, plus listed versions 8.5.518.5.538.5.548.5.558.5.56 Show 21 moreShow less8.5.578.5.588.5.598.5.608.5.618.5.638.5.648.5.658.5.668.5.688.5.698.5.708.5.718.5.728.5.738.5.758.5.768.5.778.5.788.5.798.5.81 |
8.5.82 |
tomcatMageia:8 |
before 9.0.73-1.1.mga8 | 9.0.73-1.1.mga8 |
tomcat9Ubuntu:Pro:20.04:LTS |
All versions, plus listed versions 9.0.24-19.0.27-19.0.31-19.0.31-1ubuntu0.19.0.31-1ubuntu0.2 Show 10 moreShow less9.0.31-1ubuntu0.39.0.31-1ubuntu0.49.0.31-1ubuntu0.59.0.31-1ubuntu0.69.0.31-1ubuntu0.79.0.31-1ubuntu0.89.0.31-1ubuntu0.99.0.31-1ubuntu0.9+esm19.0.31-1ubuntu0.9+esm29.0.31-1ubuntu0.9+esm3 |
None known |
tomcat9Ubuntu:Pro:22.04:LTS |
All versions, plus listed versions 9.0.43-39.0.54-19.0.55-19.0.58-19.0.58-1ubuntu0.1 Show 9 moreShow less9.0.58-1ubuntu0.1+esm19.0.58-1ubuntu0.1+esm29.0.58-1ubuntu0.1+esm39.0.58-1ubuntu0.1+esm49.0.58-1ubuntu0.29.0.58-1ubuntu0.2+esm19.0.58-1ubuntu0.2+esm29.0.58-1ubuntu0.2+esm39.0.58-1ubuntu0.2+esm4 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | Apache Tomcat Examples Web Application - Cross-Site Scripting |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, Nuclei, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-34305 is a medium vulnerability (CVSS 6.1) in Apache Tomcat, published June 23, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.71%, the 93rd percentile. Fixed in org.apache.tomcat:tomcat 10.1.0-M17.
References
lists.apache.org/thread/k04zk0nq6w57m72w5gb0r6z9ryhmvr4k
openwall.com/lists/oss-security/2022/06/23/1
security.netapp.com/advisory/ntap-20220729-0006
security.gentoo.org/glsa/202208-34
nvd.nist.gov/vuln/detail/CVE-2022-34305
github.com/advisories/GHSA-6j88-6whg-x687
Show 15 moreShow less
errata.cloudlinux.com/ubuntu18-els/CLSA-2025-1748282295.html
security-tracker.debian.org/tracker/CVE-2022-34305
advisories.mageia.org/MGASA-2023-0138.html
bugs.mageia.org/show_bug.cgi?id=30113
lists.suse.com/pipermail/sle-security-updates/2022-March/010339.html
tomcat.apache.org/security-9.html
debian.org/lts/security/2022/dla-3160
ubuntu.com/security/CVE-2022-34305
cve.org/CVERecord?id=CVE-2022-34305