Lucene search

Kaspersky LabKLA19260

HistoryAug 28, 2022 - 12:00 a.m.

KLA19260 XSS vulnerability in Apache Tomcat

2022-08-2800:00:00

Kaspersky Lab

threats.kaspersky.com

apache tomcat

xss vulnerability

apache-tomcat

cve-2022-34305

cross-site scripting

sensitive information

osi

interception

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

44.0%

JSON

Cross-site scripting (XSS) vulnerability was found in Apache Tomcat. Malicious users can exploit this vulnerability to perform cross-site scripting attack.

Original advisories

Apache Tomcat 8.5.x vulnerabilities

Related products

Apache-Tomcat

CVE list

CVE-2022-34305 high

Solution

Update to the latest version

Tomcat 8.5 Software Downloads

Impacts

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

XSS/CSS

Cross site scripting. Exploitation of vulnerabilities with this impact can lead to partial interception of information transmitted between user and site.