Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.40 through 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117 , which fix the issue.
| Vendor | Product | Versions |
|---|---|---|
| apache | tomcat | 11.0.0-M1, 10.1.0-M1, 9.0.40, 8.5.84, 8.5.100 |
Updated severity to LOW, added affected version 8.5.100, and clarified that versions 8.5.83 and below are unaffected.
Updated description with new details, changed severity to HIGH, set CVSS estimate to 7.5, and noted that no exploit is available.
Initial creation
