Apache Tomcat 9

Tenable plugin 162498 maps to CVE-2022-34305, a reflected XSS in Tomcat's examples web application, specifically the Form authentication example. The affected Tomcat line for this finding is 9.0.30 through 9.0.64, fixed in 9.0.65; other affected branches were 8.5.50-8.5.81, 10.0.0-M1-10.0.22, and 10.1.0-M1-10.1.0-M16.

The vendor's MEDIUM label is technically fair in a vacuum, but operationally inflated for enterprise patch triage. The bug is only reachable if the examples webapp is actually deployed and reachable, and exploitation still requires user interaction in a browser; that's a long way from the scanner's broad version-only match.

Why this verdict

• Downward pressure: sample app required — the vulnerable code lives in Tomcat's examples web application, not in the core servlet container, so estates that remove sample apps are not actually exposed even if the version matches.
• Downward pressure: user interaction required — the CVSS vector includes UI:R; the attacker needs a victim to load a crafted URL, which implies phishing, chat delivery, or another lure step.
• Downward pressure: browser-side impact — this is XSS with session/origin abuse potential, not JVM RCE, container escape, or arbitrary file write.
• Downward pressure: exposure fraction is narrow — in real enterprise deployments, the fraction of Tomcat servers with /examples/ still published externally should be far below the fraction merely running Tomcat 9.0.30-9.0.64.
• Baseline kept above IGNORE — if a victim with meaningful privileges browses the page and admin functions share the same origin, the attacker can still steal session context or trigger actions.

Why not higher?

There is no evidence here of unauthenticated server-side code execution, privilege escalation on the host, or easy autonomous exploitation. The chain requires both a configuration mistake (examples left deployed) and a delivery step (victim interaction), which compounds the friction hard enough to push this well below MEDIUM in most estates.

Why not lower?

It is still a real remotely triggerable web bug when the sample app is exposed, and many orgs inherit Tomcat inside third-party products that leave default content behind. If the vulnerable examples app shares origin with admin or authenticated workflows, the resulting session theft or forced actions can still hurt.

1. Remove the examples app — Delete or undeploy $CATALINA_BASE/webapps/examples (or the equivalent packaged sample app) because that removes the vulnerable surface entirely. For a LOW verdict there is no SLA from noisgate, but this is still cheap backlog hygiene and should be folded into the next normal hardening cycle.
2. Block /examples/ at the proxy — If you cannot touch the application server immediately, deny access to /examples/* at the reverse proxy, ingress, or WAF. This is an effective temporary control because the bug is tied to a specific sample application path; for LOW, do it during routine config maintenance rather than emergency change windows.
3. Verify same-origin admin exposure — Check whether Tomcat Manager, Host Manager, product admin consoles, or authenticated business apps share the same origin as the exposed examples app. If they do, the impact of this XSS rises because stolen cookies and browser-driven actions become more valuable.
4. Patch during regular maintenance — Upgrade to 9.0.65+ or consume the relevant distro backport to close the finding cleanly. For a LOW verdict, keep it in scheduled remediation rather than front-of-queue emergency patching.

Run this on the target host or on a mounted Tomcat installation directory. Invoke it as python3 check_tomcat_cve_2022_34305.py /opt/tomcat or python check_tomcat_cve_2022_34305.py "C:\Program Files\Apache Software Foundation\Tomcat 9.0"; no admin rights are required if you can read the Tomcat files.

#!/usr/bin/env python3
# check_tomcat_cve_2022_34305.py
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import re
import sys
import zipfile
from pathlib import Path


def parse_version(v):
    m = re.match(r'^(\d+)\.(\d+)\.(\d+)', v or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def read_manifest_version(catalina_jar):
    try:
        with zipfile.ZipFile(catalina_jar, 'r') as zf:
            data = zf.read('META-INF/MANIFEST.MF').decode('utf-8', errors='ignore')
        for line in data.splitlines():
            if line.startswith('Implementation-Version:'):
                return line.split(':', 1)[1].strip()
            if line.startswith('Specification-Version:'):
                spec = line.split(':', 1)[1].strip()
                if spec:
                    return spec
    except Exception:
        return None
    return None


def find_version(base):
    candidates = [
        base / 'lib' / 'catalina.jar',
        base / 'bin' / 'bootstrap.jar',
    ]
    for c in candidates:
        if c.exists():
            v = read_manifest_version(c)
            if v:
                return v

    release_notes = [
        base / 'RELEASE-NOTES',
        base / 'RUNNING.txt',
        base / 'webapps' / 'ROOT' / 'RELEASE-NOTES.txt',
    ]
    for rn in release_notes:
        if rn.exists():
            try:
                text = rn.read_text(errors='ignore')
                m = re.search(r'Apache Tomcat Version\s+([0-9]+\.[0-9]+\.[0-9]+)', text)
                if m:
                    return m.group(1)
            except Exception:
                pass
    return None


def examples_present(base):
    paths = [
        base / 'webapps' / 'examples',
        base / 'webapps' / 'examples.war',
        base / 'webapps-javaee' / 'examples',
        base / 'webapps-javaee' / 'examples.war',
    ]
    return any(p.exists() for p in paths)


def vulnerable_range(version_tuple):
    # Plugin scope: Tomcat 9.0.30 < 9.0.65
    return (9, 0, 30) <= version_tuple < (9, 0, 65)


def main():
    if len(sys.argv) != 2:
        print('UNKNOWN - usage: python3 check_tomcat_cve_2022_34305.py <CATALINA_BASE_or_HOME>')
        sys.exit(2)

    base = Path(sys.argv[1])
    if not base.exists() or not base.is_dir():
        print(f'UNKNOWN - path not found: {base}')
        sys.exit(2)

    version = find_version(base)
    if not version:
        print('UNKNOWN - could not determine Tomcat version from local files')
        sys.exit(2)

    vt = parse_version(version)
    if not vt:
        print(f'UNKNOWN - unparseable Tomcat version: {version}')
        sys.exit(2)

    has_examples = examples_present(base)

    if vulnerable_range(vt) and has_examples:
        print(f'VULNERABLE - Tomcat {version} with examples webapp present')
        sys.exit(1)
    elif vulnerable_range(vt) and not has_examples:
        print(f'PATCHED - Tomcat {version} is in affected range but examples webapp is absent; CVE-2022-34305 not reachable locally')
        sys.exit(0)
    else:
        print(f'PATCHED - Tomcat {version} is outside plugin affected range')
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Tenable plugin 162498
2. Apache Tomcat 9 security page
3. NVD CVE-2022-34305
4. Tenable CVE page with EPSS
5. Debian security tracker CVE-2022-34305
6. Ubuntu CVE-2022-34305
7. Apache Tomcat security considerations
8. CISA Known Exploited Vulnerabilities catalog