Published: 12/05/2022 Updated: 06/04/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 447

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

A flaw was found in Spring Framework, specifically within two modules called Spring MVC and Spring WebFlux, (transitively affected from Spring Beans), using parameter data binding. This flaw allows an malicious user to pass specially-constructed malicious requests to certain parameters and possibly gain access to normally-restricted functionality within the Java Virtual Machine. (CVE-2022-22965) The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks. (CVE-2022-29885)

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache tomcat 10.1.0
apache tomcat
debian debian linux 10.0
debian debian linux 11.0
oracle hospitality cruise shipboard property management system 20.2.1

Several security vulnerabilities have been discovered in the Tomcat servlet and JSP engine CVE-2021-43980 The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9047 onwards exposed a long standing (but extremely hard to trigger) concurrency bug that could cause client connec ...

A flaw was found in the tomcat package When a web application sends a WebSocket message concurrently with the WebSocket connection closing, the application may continue to use the socket after it has been closed In this case, the error handling triggered could cause the pooled object to be placed in the pool twice This issue results in subsequen ...

A flaw was found in Spring Framework, specifically within two modules called Spring MVC and Spring WebFlux, (transitively affected from Spring Beans), using parameter data binding This flaw allows an attacker to pass specially-constructed malicious requests to certain parameters and possibly gain access to normally-restricted functionality within ...

Apache Guaqmole 1.4.0 based on Tomcat 9.0.64

This work is based on the work of: githubcom/oznu/docker-guacamole A Docker Container for Apache Guacamole, a client-less remote desktop gateway It supports standard protocols like VNC, RDP, and SSH over HTML5 This image will run on most platforms that support Docker including Docker for arm64 boards (Raspberry ARM64v8 on an 64bit OS) This container runs the guacamo

PTVULNSEARCHER Common Vulnerabilities and Exposures Searcher ptvulnsearcher is a tool for searching CVE (Common Vulnerabilities and Exposures) This tool allows searching using keywords or exact CVE Installation pip install ptvulnsearcher Add to PATH If you cannot invoke the script in your terminal, its probably because its not in your

Apache Tomcat CVE-2022-29885

CVE-2022-29885 The tool is only used for security research It is prohibited to use the tool to launch illegal attacks, and the user is responsible for the consequences 工具仅用于安全研究以及内部自查，禁止使用工具发起非法攻击，造成的后果使用者负责 Introduce Apache Tomcat DoS (CVE-2022-29885) Exploit Denial of Service in EncryptInterceptor

Common Vulnerabilities and Exposures Searcher

PTVULNSEARCHER Common Vulnerabilities and Exposures Searcher ptvulnsearcher is a tool for searching CVE (Common Vulnerabilities and Exposures) This tool allows searching using keywords or exact CVE Installation pip install ptvulnsearcher Add to PATH If you cannot invoke the script in your terminal, its probably because its not in your

Apache Tomcat DoS (CVE-2022-29885) Exploit

CVE-2022-29885 by 1vere$k Apache Tomcat DoS (CVE-2022-29885) Exploit Denial of Service in EncryptInterceptor (Tomcat Cluster) The target machine needs to start the Cluster Nio Receiver Sending a special TCP packet will cause a Denial of Service to the target Whether EncryptInterceptor is used or not, there is the possibility of denial of service vulnerability with condition

CWE-400 https://lists.apache.org/thread/2b4qmhbcyqvc7dyfpjyx54c03x65vhcv https://security.netapp.com/advisory/ntap-20220629-0002/https://www.oracle.com/security-alerts/cpujul2022.html https://lists.debian.org/debian-lts-announce/2022/10/msg00029.html https://www.debian.org/security/2022/dsa-5265 http://packetstormsecurity.com/files/171728/Apache-Tomcat-10.1-Denial-Of-Service.html https://nvd.nist.gov https://www.debian.org/security/2022/dsa-5265 https://github.com/nikkadim/guacamole140 https://alas.aws.amazon.com/AL2/ALASTOMCAT8.5-2023-005.html

CVE-2022-29885

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect