CVE-2022-34305

6.1

CVSS

Description

In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.

Attack Vector

Privileges Req.

User Interaction

apache tomcat

Updated Nov 10, 2026View on NVD →

S4E scanner

mediumProduct Based Network Vulnerabilities~10 seconds

Apache Tomcat Examples Web Application - Cross-Site Scripting

Apache Tomcat 8.5.50 to 8.5.81, 9.0.30 to 9.0.64, 10.0.0-M1 to 10.0.22, and 10.1.0-M1 to 10.1.0-M16 contain a reflected cross-site scripting caused by displaying unfiltered user data in the Form authentication example, letting attackers execute scripts in victim browsers, exploit requires attacker to craft malicious input. References: https://nvd.nist.gov/vuln/detail/cve-2022-34305 https://github.com/zeroc00I/CVE-2022-34305 https://lists.apache.org/thread/k04zk0nq6w57m72w5gb0r6z9ryhmvr4k https://security.gentoo.org/glsa/202208-34 Remediation: Update to the latest version of Apache Tomcat where this issue is fixed.

Used 20 times · 10 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: apache tomcat

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →