← Back

CVE-2022-23181

nvd nist
Published: Jan 27, 2022Modified: Jun 17, 2026

JSON object

Loading...
7.0
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.0 / Impact: 5.9
Source: NVD

Description

The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.

Affected (26)

Apache
1 product
Tomcat
Oracle
5 products
Agile Engineering Data Management
Communications Cloud Native Core Policy
Financial Services Crime And Compliance Management Studio
Managed File Transfer
Mysql Enterprise Monitor
Debian
1 product
Debian Linux
Configuration A
17 vulnerable
Vulnerable SoftwareAffected Versions
Apache
Tomcat
From 10.0.1 to 10.0.14
Tomcat
From 8.5.55 to 8.5.73
Tomcat
From 9.0.35 to 9.0.56
Tomcat
Version 10.0.0 milestone10
Tomcat
Version 10.0.0 milestone5
Tomcat
Version 10.0.0 milestone6
Tomcat
Version 10.0.0 milestone7
Tomcat
Version 10.0.0 milestone8
Tomcat
Version 10.0.0 milestone9
Tomcat
Version 10.1.0 milestone1
Tomcat
Version 10.1.0 milestone2
Tomcat
Version 10.1.0 milestone3
Tomcat
Version 10.1.0 milestone4
Tomcat
Version 10.1.0 milestone5
Tomcat
Version 10.1.0 milestone6
Tomcat
Version 10.1.0 milestone7
Tomcat
Version 10.1.0 milestone8
Configuration B
7 vulnerable
Vulnerable SoftwareAffected Versions
Agile Engineering Data Management
Version 6.2.1.0
Communications Cloud Native Core Policy
Version 1.15.0
Oracle
Financial Services Crime And Compliance Management Studio
Version 8.0.8.2.0
Financial Services Crime And Compliance Management Studio
Version 8.0.8.3.0
Oracle
Managed File Transfer
Version 12.2.1.3.0
Managed File Transfer
Version 12.2.1.4.0
Mysql Enterprise Monitor
Up to 8.0.29
Configuration C
2 vulnerable
Vulnerable SoftwareAffected Versions
Debian
Debian Linux
Version 10.0
Debian Linux
Version 11.0

Related CWEs

CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.

References (12)

Source: security@apache.org
Mailing ListMitigationVendor Advisory
Source: security@apache.org
Mailing ListThird Party Advisory
Source: security@apache.org
Third Party Advisory
Source: security@apache.org
Third Party Advisory
Source: security@apache.org
PatchThird Party Advisory
Source: security@apache.org
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListMitigationVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory

Timeline

No history available yet.