Read the docs
TI-2022-15216 Aliases CVE-2022-34305GHSA-6j88-6whg-x687

XSS in examples web application

Priority LOW 37CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.06714 93rd percentileScored 2026-11-07
Fix Partial org.apache.tomcat:tomcat (Maven): 10.1.0-M17, 10.0.22, 9.0.65 +1Red Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache TomcatApache Tomcat 8.5 8.5.50 to 8.5.81; Apache Tomcat 9 9.0.30 to 9.0.64; Apache Tomcat 10.0 10.0.0-M1 to 10.0.22; Apache Tomcat 10.1 10.1.0-M1 to 10.1.0-M16—No fix listedCNA
—org.apache.tomcat:tomcat (Maven)10.1.0-M1 to before 10.1.0-M1710.1.0-M17Patch availableGHSA-6j88-6whg-x687
—org.apache.tomcat:tomcat (Maven)10.0.0-M1 to before 10.0.2210.0.22Patch availableGHSA-6j88-6whg-x687
—org.apache.tomcat:tomcat (Maven)9.0.30 to before 9.0.659.0.65Patch availableGHSA-6j88-6whg-x687
—org.apache.tomcat:tomcat (Maven)8.5.50 to before 8.5.828.5.82Patch availableGHSA-6j88-6whg-x687
  • Apache Tomcat VendorApache Affected Apache Tomcat 8.5 8.5.50 to 8.5.81; Apache Tomcat 9 9.0.30 to 9.0.64; Apache Tomcat 10.0 10.0.0-M1 to 10.0.22; Apache Tomcat 10.1 10.1.0-M1 to 10.1.0-M16 Fixed in — No fix listed CNA
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 10.1.0-M1 to before 10.1.0-M17 Fixed in 10.1.0-M17 Patch available GHSA-6j88-6whg-x687
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 10.0.0-M1 to before 10.0.22 Fixed in 10.0.22 Patch available GHSA-6j88-6whg-x687
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 9.0.30 to before 9.0.65 Fixed in 9.0.65 Patch available GHSA-6j88-6whg-x687
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 8.5.50 to before 8.5.82 Fixed in 8.5.82 Patch available GHSA-6j88-6whg-x687

CPE configurations NVD · 17

CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*8.5.50 – 8.5.81; 9.0.30 – 9.0.64; 10.0.0 – 10.0.22VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone1:*:*:*:*:*:*10.1.0 milestone1VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone10:*:*:*:*:*:*10.1.0 milestone10VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone11:*:*:*:*:*:*10.1.0 milestone11VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone12:*:*:*:*:*:*10.1.0 milestone12VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone13:*:*:*:*:*:*10.1.0 milestone13VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone14:*:*:*:*:*:*10.1.0 milestone14VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone15:*:*:*:*:*:*10.1.0 milestone15VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone16:*:*:*:*:*:*10.1.0 milestone16VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone2:*:*:*:*:*:*10.1.0 milestone2VulnerableApache
  • cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions 8.5.50 – 8.5.81; 9.0.30 – 9.0.64; 10.0.0 – 10.0.22 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone1:*:*:*:*:*:* Versions 10.1.0 milestone1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone10:*:*:*:*:*:* Versions 10.1.0 milestone10 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone11:*:*:*:*:*:* Versions 10.1.0 milestone11 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone12:*:*:*:*:*:* Versions 10.1.0 milestone12 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone13:*:*:*:*:*:* Versions 10.1.0 milestone13 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone14:*:*:*:*:*:* Versions 10.1.0 milestone14 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone15:*:*:*:*:*:* Versions 10.1.0 milestone15 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone16:*:*:*:*:*:* Versions 10.1.0 milestone16 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone2:*:*:*:*:*:* Versions 10.1.0 milestone2 Vulnerable ·Apache
Show 7 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:10.1.0:milestone3:*:*:*:*:*:*10.1.0 milestone3VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone4:*:*:*:*:*:*10.1.0 milestone4VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone5:*:*:*:*:*:*10.1.0 milestone5VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone6:*:*:*:*:*:*10.1.0 milestone6VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone7:*:*:*:*:*:*10.1.0 milestone7VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone8:*:*:*:*:*:*10.1.0 milestone8VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone9:*:*:*:*:*:*10.1.0 milestone9VulnerableApache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone3:*:*:*:*:*:* Versions 10.1.0 milestone3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone4:*:*:*:*:*:* Versions 10.1.0 milestone4 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone5:*:*:*:*:*:* Versions 10.1.0 milestone5 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone6:*:*:*:*:*:* Versions 10.1.0 milestone6 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone7:*:*:*:*:*:* Versions 10.1.0 milestone7 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone8:*:*:*:*:*:* Versions 10.1.0 milestone8 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone9:*:*:*:*:*:* Versions 10.1.0 milestone9 Vulnerable ·Apache

Remediation

  • Fix · GHSA-6j88-6whg-x687 org.apache.tomcat:tomcat (Maven) Fixed in 10.1.0-M17 Advisory →
  • Fix · GHSA-6j88-6whg-x687 org.apache.tomcat:tomcat (Maven) Fixed in 10.0.22 Advisory →
  • Fix · GHSA-6j88-6whg-x687 org.apache.tomcat:tomcat (Maven) Fixed in 9.0.65 Advisory →
  • Fix · GHSA-6j88-6whg-x687 org.apache.tomcat:tomcat (Maven) Fixed in 8.5.82 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7AffectedNo fix yet: Fix deferred
Red Hat JBoss Web Server 3AffectedNo fix planned: Out of support scope
Not affected: 5 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat JBoss Web Server 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-34305
  2. 2026-10-03 Alias added: GHSA-6j88-6whg-x687
  3. 2026-10-08 CISA SSVC decision points changed

References

Advisory 5

Other 1

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
See all 273 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences