CVE-2022-34305: Apache Tomcat

Medium severity, CVSS 6.1. EPSS: 6.7% chance of exploitation in the next 30 days.

In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.

Affected products

• Apache Tomcat: from 8.5.50, up to and including 8.5.81; from 9.0.30, up to and including 9.0.64; from 10.0.0, up to and including 10.0.22; version 10.1.0 only

Published 2022-06-23. Last modified 2026-10-08.