Description
The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.
Remediation
References
https://lists.apache.org/thread/yqkd183xrw3wqvnpcg3osbcryq85fkzj
https://security.gentoo.org/glsa/202305-37
Related Vulnerabilities
CVE-2023-36479 Vulnerability in maven package org.eclipse.jetty.ee10:jetty-ee10-servlets
CVE-2023-34620 Vulnerability in maven package org.hjson:hjson
CVE-2019-17554 Vulnerability in maven package org.apache.olingo:odata-server-api
CVE-2022-1471 Vulnerability in maven package org.yaml:snakeyaml
CVE-2019-10352 Vulnerability in maven package org.jenkins-ci.main:jenkins-core