CVEvulnerability

CVE-2022-23181

7.0 HIGH Published 2022-01-27 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-01-27
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.0 HIGH — CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
3.7 LOW — AV:L/AC:H/Au:N/C:P/I:P/A:P
Weaknesses
CWE-367

Description

The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.

Affected configurations

• apache tomcat (>= 8.5.55 <= 8.5.73) • apache tomcat (>= 9.0.35 <= 9.0.56) • apache tomcat (>= 10.0.1 <= 10.0.14) • apache tomcat 10.0.0 • apache tomcat 10.1.0 • oracle agile engineering data management 6.2.1.0 • oracle communications cloud native core policy 1.15.0 • oracle financial services crime and compliance management studio 8.0.8.2.0 • oracle financial services crime and compliance management studio 8.0.8.3.0 • oracle managed file transfer 12.2.1.3.0 • oracle managed file transfer 12.2.1.4.0 • oracle mysql enterprise monitor (<= 8.0.29) • debian debian linux 10.0 • debian debian linux 11.0

Related

Weakness · CWE (1)

  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition weakness

References