Bug 2102817 (CVE-2022-34305)

Summary:	CVE-2022-34305 tomcat: XSS in examples web application
Product:	[Other] Security Response	Reporter:	Patrick Del Bello <pdelbell>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	aileenc, alee, chazlett, ckelley, coolsvap, csutherl, edewata, gmalinko, gzaronikas, ivan.afonichev, janstey, java-sig-commits, jclere, jochrist, jwon, krzysztof.daniel, mharmsen, mmadzin, mulliken, pdelbell, peholase, pjindal, rhcs-maint, skhandel, szappis
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	Tomcat 10.1.0-M17, Tomcat 10.0.23, Tomcat 9.0.65, Tomcat 8.5.82	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the Apache Tomcat package. An example web application did not filter the form authentication example, exposing a Cross-site scripting (XSS) vulnerability.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2102819
Bug Blocks:	2102443

Description Patrick Del Bello 2022-06-30 17:52:58 UTC

In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.

https://lists.apache.org/thread/k04zk0nq6w57m72w5gb0r6z9ryhmvr4k
http://www.openwall.com/lists/oss-security/2022/06/23/1

Comment 1 Patrick Del Bello 2022-06-30 17:56:16 UTC

Created tomcat tracking bugs for this issue:

Affects: fedora-all [bug 2102819]