CVE-2022-45143 in Agile Engineering Data Management

Summary

The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Reservation

11/10/2022

Disclosure

01/03/2023

Status

Confirmed

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
234957	Oracle Agile Engineering Data Management Installation injection	74	Not defined	Official fix	CVE-2022-45143
234728	Oracle Financial Services Compliance Studio injection	74	Not defined	Official fix	CVE-2022-45143
234493	Oracle Commerce Guided Search Endeca Application Controller		Not defined	Official fix	CVE-2022-45143
226721	Oracle Agile PLM Security injection	74	Not defined	Official fix	CVE-2022-45143
226653	Oracle MySQL Enterprise Monitor injection	74	Not defined	Official fix	CVE-2022-45143
226418	Oracle SD-WAN Edge Internal tools injection	74	Not defined	Official fix	CVE-2022-45143
226416	Oracle Communications Session Report Manager BEServer injection	74	Not defined	Official fix	CVE-2022-45143
226409	Oracle Communications Element Manager BEServer injection	74	Not defined	Official fix	CVE-2022-45143
226407	Oracle Communications Diameter Signaling Router Platform injection	74	Not defined	Official fix	CVE-2022-45143
226394	Oracle Communications Cloud Native Core Binding Support Function Policy injection	74	Not defined	Official fix	CVE-2022-45143
226336	Oracle Commerce Guided Search Content Acquisition System/Workbench injection	74	Not defined	Official fix	CVE-2022-45143
217292	Apache Tomcat JsonErrorReportValve injection	74	Not defined	Official fix	CVE-2022-45143

Sources

• MITRE
• NVD
• CVE Details