Description
The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.
Remediation
References
https://lists.apache.org/thread/yqkd183xrw3wqvnpcg3osbcryq85fkzj
https://security.gentoo.org/glsa/202305-37
https://security.netapp.com/advisory/ntap-20230216-0009/
Related Vulnerabilities
CVE-2019-16544 Vulnerability in maven package org.jenkins-ci.plugins:qmetry-for-jira-test-management
CVE-2021-41973 Vulnerability in maven package org.apache.mina:mina-http
CVE-2022-22965 Vulnerability in maven package org.springframework:spring-webmvc
CVE-2020-9498 Vulnerability in maven package org.apache.guacamole:guacamole