In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 6.1 · apacheNVD modified 2026-10-08 22:17
Affected (CPE criteria) 17
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone1:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone10:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone11:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone12:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone13:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone14:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone15:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone16:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone2:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone3:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone4:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone5:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone6:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone7:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone8:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone9:*:*:*:*:*:*
References 8
- http://www.openwall.com/lists/oss-security/2022/06/23/1 Mailing List, Third Party Advisory
- https://lists.apache.org/thread/k04zk0nq6w57m72w5gb0r6z9ryhmvr4k Mailing List, Release Notes, Third Party Advisory
- https://security.gentoo.org/glsa/202208-34 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220729-0006/ Third Party Advisory
- http://www.openwall.com/lists/oss-security/2022/06/23/1 Mailing List, Third Party Advisory
- https://lists.apache.org/thread/k04zk0nq6w57m72w5gb0r6z9ryhmvr4k Mailing List, Release Notes, Third Party Advisory
- https://security.gentoo.org/glsa/202208-34 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220729-0006/ Third Party Advisory