An improper output encoding vulnerability in the Apache Tomcat JsonAccessLogValve allows unauthenticated attackers to potentially access sensitive information.

This flaw involves CWE-116, Improper Encoding or Escaping of Output, within the JsonAccessLogValve component. The vulnerability is exploitable by unauthenticated remote attackers, as indicated by the CVSS vector AV:N/AC:L/PR:N.

The vulnerability carries a CVSS score of 7.5, which classifies it as a High severity risk. Successful exploitation could lead to unauthorized information disclosure, potentially exposing sensitive data contained within access logs. This creates significant risks for organizations, including regulatory non-compliance, loss of customer trust, and potential exposure of internal system architecture.

Immediate Action: Upgrade to Apache Tomcat versions 11.0.21, 10.1.54, or 9.0.117 to apply the necessary security fixes.

Proactive Monitoring: Review web server access logs for anomalous patterns or unexpected characters that may indicate attempts to inject or manipulate log output.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious payloads targeting log-processing components.

Public Exploit Available: Unknown

Given the High severity rating and the potential for unauthenticated access to sensitive log information, organizations should prioritize updating their Apache Tomcat instances to the latest patched versions. Testing these updates in a staging environment is advised to ensure compatibility before deploying to production systems.