CVE-2022-34305: Cross-site Scripting in Apache Tomcat
Summary
CVE-2022-34305: Cross-site Scripting in Apache Tomcat. Affects org.apache.tomcat:tomcat across 4 version ranges.
>= 8.5.50, < 8.5.82
>= 9.0.30, < 9.0.65
>= 10.0.0-M1, < 10.0.22
>= 10.1.0-M1, < 10.1.0-M17
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
The same CVE-2022-34305 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications. It provides a robust and scalable platform for running Java web applications. However, versions 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64, and 8.5.50 to 8.5.81 of Apache Tomcat are vulnerable to a cross-site scripting (XSS) attack. This vulnerability exists in the Form authentication example in the examples web application, where user-provided data is displayed without proper filtering, exposing a potential XSS vulnerability.
Vulnerability Detail
The XSS vulnerability in Apache Tomcat allows an attacker to inject malicious scripts into web pages viewed by other users. This can lead to various security risks, including the theft of sensitive information, session hijacking, and unauthorized access to user accounts. The vulnerability arises due to the lack of input validation and output encoding in the Form authentication example of the examples web application. Attackers can exploit this vulnerability by injecting malicious scripts into user-provided data, which is then displayed on web pages without proper filtering.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 8.5.50, < 8.5.828.5.82 -
>= 9.0.30, < 9.0.659.0.65 -
>= 10.0.0-M1, < 10.0.2210.0.22 -
>= 10.1.0-M1, < 10.1.0-M1710.1.0-M17
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can disable or remove the examples web application from your Apache Tomcat installation. This can be done by deleting or commenting out the 'examples' entry in the 'webapps' directory of your Apache Tomcat installation. However, this workaround will remove access to the examples web application for all users.
Conclusion
In conclusion, Apache Tomcat versions 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64, and 8.5.50 to 8.5.81 are vulnerable to a cross-site scripting (XSS) attack. It is crucial to upgrade to the latest patched version of Apache Tomcat to mitigate this vulnerability. Additionally, a temporary workaround is available by disabling or removing the examples web application. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
The potential risks of this vulnerability include the theft of sensitive information, session hijacking, and unauthorized access to user accounts.
To fix this vulnerability, it is recommended to upgrade to the latest patched version of Apache Tomcat.
Yes, a temporary workaround is to disable or remove the examples web application from your Apache Tomcat installation.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
