CVE-2022-34305 Public exploit EPSS 6.7%

XSS in examples web application

Apache Software Foundation · Apache Tomcat

Official description · CVE.org

In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.

Breakdown

59.9 / 100

Exploited: Yes, in VulnCheck KEV
Reports: 0
Tactics: 0/15

First seen exploited 17 months after disclosure.

Disclosed23 Jun 2022day 0
First seen exploitedVulnCheck KEV evidence9 Nov 2023+17 mo

7 fixes in tomcat over 24 months. The latest fix listed for tomcat is 11.0.0-M12.

Fixes in tomcatMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

10.0.16CVE-2022-2318127 Jan 2022
10.1.0-M6CVE-2021-4234014 Oct 2021
10.1.0-M14CVE-2021-4398028 Sep 2022
10.1.0-M15CVE-2022-2988512 May 2022
10.1.0-M17CVE-2022-3430523 Jun 2022
11.0.0-M11CVE-2023-4108025 Aug 2023
11.0.0-M12CVE-2023-4279510 Oct 2023Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.apache.tomcat:tomcat.

Mavenorg.apache.tomcat:tomcatGHSA-6j88-6whg-x687

Upgrade to 10.0.22

Fixes this CVE and 4 other known vulnerabilities in this package (CVE-2020-13934, CVE-2020-13935, +2).

Also affected, despite being newer: 10.1.0-M1 up to 10.1.0-M17.

Set the version to 10.0.22 or later in your pom.xml or build.gradle.

The first fix for CVE-2022-34305.

Affected versions, by release line

If you run	Upgrade to
10.1.0-M1 up to 10.1.0-M17	10.1.45first fix for this CVE: 10.1.0-M17
10.0.0-M1 up to 10.0.22	10.0.22
9.0.30 up to 9.0.65	9.0.109first fix for this CVE: 9.0.65
8.5.50 up to 8.5.82 Still affected on this line by CVE-2025-55752 (no fix published).	8.5.82

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 2 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

ACTUALIZACION | Oracle Critical Patch Update Advisory - July 202321 Jul 2023
Apache Tomcat Cross-Site Scripting Vulnerability28 Jun 2022

References

4 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2022-5963

Public exploitAdvisories link exploit code.

, 30 Oct 2026

6.7%Top 6.1%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 93.9%).

No CVSS score published.

Priority factorsFormula

In a KEV cataloglisted in VulnCheck KEV 35.0/35

Recent KEV listingadded 1087 days ago 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9391 18.8/20

Threat reports0 reports 0.0/10

Public exploit code1 nuclei template 5.0/5

Mentioned in OTX pulses2 pulses 1.1/3

CVSS base scoreno CVSS 0.0/7

End-of-life productsupported or unknown 0.0

Total59.9

Record

Published: 23 Jun 2022
Modified: 8 Oct 2026
: CWE-79 Improper Neutralization of Input During Web Page Generation
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Fixes in tomcatMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Am I affected? What do I upgrade to?

Affected versions, by release line

What security researchers reported

Also mentioned in 2 community threat pulses (AlienVault OTX)

References

x_refsource_MISC 1

mailing-list 1

x_refsource_CONFIRM 1

vendor-advisory 1

techniques